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MESSAGE FROM THE DIRECTOR 


The U.S. Secret Service has a longstanding tradition of conducting threat assessments as part of its mandate to ensure 
the safety of this Nation’s highest elected officials. Our National Threat Assessment Center (NTAC) is dedicated to 
expanding the field of violence prevention by closely examining the targeted violence that affects communities across the 
United States. As part of this mission, NTAC has maintained a particular focus on the prevention of targeted school 
violence. For 20 years, the Center has studied these tragedies, and the following report titled, Protecting America’s 
Schools: A U.S. Secret Service Analysis of Targeted School Violence, supports past Secret Service research findings that 
indicate targeted school violence is preventable. 

While communities can advance many school safety measures on their own, our experience tells us that keeping schools 
safe requires a team effort and the combined resources of the federal, state, and local governments; school boards; law 
enforcement; and the public. With this study, the Secret Service provides an unprecedented base of facts about school 
violence, as well as an updated methodology and practical guidelines for prevention. We encourage all of our public safety 
partners and education partners to review the information within, and to use it to guide the best practices for maintaining 
a safe learning environment for all children. 

For 150 years, the men and women of the Secret Service have carried out our no-fail mission to protect the Nation’s 
leaders and financial infrastructure. Our relationships across the federal, state, and local level have been instrumental 
to our success. The agency is committed to carrying on this collaborative approach to better protect our children and our 
schools. We are proud to release this report. 




Director 


The U.S. Secret Service’s National Threat Assessment Center (NTAC) was created in 1998 to provide guidance on threat assessment both within the U.S. 
Secret Service and to others with criminal justice and public safety responsibilities. Through the Presidential Threat Protection Act of 2000, Congress 
formally authorized NTAC to conduct research on threat assessment and various types of targeted violence; provide training on threat assessment and 
targeted violence; facilitate information-sharing among agencies with protective and/or public safety responsibilities; provide case consultation on 
individual threat assessment investigations and for agencies building threat assessment units; and develop programs to promote the standardization of 
federal, state, and local threat assessment processes and investigations. 
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EXECUTIVE SUMMARY 


Ensuring the safety of children at school is a responsibility that belongs to everyone, including law enforcement, school 
staff, mental health practitioners, government officials, and members of the general public. To aid in these efforts, the U.S. 
Secret Service National Threat Assessment Center (NTAC) studied 41 incidents of targeted school violence that occurred 
at K-12 schools in the United States from 2008 to 2017. This report builds on 20 years of NTAC research and guidance 
in the field of threat assessment by offering an in-depth analysis of the motives, behaviors, and situational factors of the 
attackers, as well as the tactics, resolutions, and other operationally-relevant details of the attacks. 

The analysis suggests that many of these tragedies could have been prevented, and supports the importance of schools 
establishing comprehensive targeted violence prevention programs as recommended by the Secret Service in Enhancing 
School Safety Using a Threat Assessment Model: An Operational Guide for Preventing Targeted School Violence. 1 This 
approach is intended to identify students of concern, assess their risk for engaging in violence or other harmful activities, 
and implement intervention strategies to manage that risk. The threshold for intervention should be low, so that schools 
can identify students in distress before their behavior escalates to the level of eliciting concerns about safety. 

Because most of these attacks ended very quickly, law enforcement rarely had the opportunity to intervene before serious 
harm was caused to students or staff. Additionally, many of the schools that experienced these tragedies had implemented 
physical security measures (e.g., cameras, school resource officers, lockdown procedures). Prevention is key. 

Some of the key findings from this study, and their implications for informing school violence prevention efforts, include: 

• There is no profile of a student attacker, nor is there a profile for the type of school that has been targeted: 

Attackers varied in age, gender, race, grade level, academic performance, and social characteristics. Similarly, 
there was no identified profile of the type of school impacted by targeted violence, as schools varied in size, 
location, and student-teacher ratios. Rather than focusing on a set of traits or characteristics, a threat assessment 
process should focus on gathering relevant information about a student’s behaviors, situational factors, and 
circumstances to assess the risk of violence or other harmful outcomes. 

• Attackers usually had multiple motives, the most common involving a grievance with classmates: In addition to 
grievances with classmates, attackers were also motivated by grievances involving school staff, romantic 
relationships, or other personal issues. Other motives included a desire to kill, suicide, and seeking fame or 
notoriety. Discovering a student’s motive for engaging in concerning behavior is critical to assessing the 
student’s risk of engaging in violence and identifying appropriate interventions to change behavior and 
manage risk. 

• Most attackers used firearms, and firearms were most often acquired from the home: Many of the attackers 
were able to access firearms from the home of their parents or another close relative. While many of the firearms 
were unsecured, in several cases the attackers were able to gain access to firearms that were secured in a locked 
gun safe or case. It should be further noted, however, that some attackers used knives instead of firearms to 
perpetrate their attacks. Therefore, a threat assessment should explore if a student has access to any weapons, 
with a particular focus on weapons access at home. Schools, parents, and law enforcement must work together 
rapidly to restrict access to weapons in those cases when students pose a risk of harm to themselves or others. 

• Most attackers had experienced psychological, behavioral, or developmental symptoms: The observable mental 
health symptoms displayed by attackers prior to their attacks were divided into three main categories: 
psychological (e.g., depressive symptoms or suicidal ideation), behavioral (e.g., defiance/misconduct or symptoms 
of ADHD/ADD), and neurological/developmental (e.g., developmental delays or cognitive deficits). The fact that half 
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of the attackers had received one or more mental health services prior to their attack indicates that mental health 
evaluations and treatments should be considered a component of a multidisciplinary threat assessment, but not 
a replacement. Mental health professionals should be included in a collaborative threat assessment process that 
also involves teachers, administrators, and law enforcement. 

• Half of the attackers had interests in violent topics: Violent interests, without an appropriate explanation, are 
concerning, which means schools should not hesitate to initiate further information gathering, assessment, and 
management of the student’s behavior. For example, a student who is preoccupied or fixated on topics like the 
Columbine shooting or Hitler, as was noted in the backgrounds of several of the attackers in this study, may be the 
focus of a school threat assessment to determine how such an interest originated and if the interest is negatively 
impacting the student’s thinking and behavior. 

• All attackers experienced social stressors involving their relationships with peers and/or romantic partners: 

Attackers experienced stressors in various areas of their lives, with nearly all experiencing at least one in the six 
months prior to their attack, and half within two days of the attack. In addition to social stressors, other stressors 
experienced by many of the attackers were related to families and conflicts in the home, academic or disciplinary 
actions, or other personal issues. All school personnel should be trained to recognize signs of a student in crisis. 
Additional training should focus on crisis intervention, teaching students skills to manage emotions and resolve 
conflicts, and suicide prevention. 

• Nearly every attacker experienced negative home life factors: The negative home life factors experienced by 
the attackers included parental divorce or separation, drug use or criminal charges among family members, or 
domestic abuse. While none of the factors included here should be viewed as predictors that a student will be 
violent, past research has identified an association between many of these types of factors and a range of negative 
outcomes for children. 

• Most attackers were victims of bullying, which was often observed by others: Most of the attackers were 
bullied by their classmates, and for over half of the attackers the bullying appeared to be of a persistent pattern 
which lasted for weeks, months, or years. It is critical that schools implement comprehensive programs designed to 
promote safe and positive school climates, where students feel empowered to report bullying when they witness it 
or are victims of it, and where school officials and other authorities act to intervene. 

• Most attackers had a history of school disciplinary actions, and many had prior contact with law enforcement: 

Most attackers had a history of receiving school disciplinary actions resulting from a broad range of 
inappropriate behavior. The most serious of those actions included the attacker being suspended, expelled, or 
having law enforcement interactions as a result of their behavior at school. An important point for school staff 
to consider is that punitive measures are not preventative. If a student elicits concern or poses a risk of harm 
to self or others, removing the student from the school may not always be the safest option. To help in making 
the determination regarding appropriate discipline, schools should employ disciplinary practices that ensure 
fairness, transparency with the student and family, and appropriate follow-up. 

• All attackers exhibited concerning behaviors . Most elicited concern from others, and most communicated their 
intent to attack: The behaviors that elicited concern ranged from a constellation of lower-level concerns to 
objectively concerning or prohibited behaviors. Most of the attackers communicated a prior threat to their target or 
communicated their intentions to carry out an attack. In many cases, someone observed a threatening 
communication or behavior but did not act, either out of fear, not believing the attacker, misjudging the immediacy or 
location, or believing they had dissuaded the attacker. Students, school personnel, and family members should be 
encouraged to report troubling or concerning behaviors to ensure that those in positions of authority can intervene. 

A multidisciplinary threat assessment team, in conjunction with the appropriate policies, tools, and training, is the best 
practice for preventing future tragedies. A thorough review of the findings contained in this report should make clear that 
tangible steps can be taken to reduce the likelihood that any student would cause harm, or be harmed, at school. 
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INTRODUCTION 


For the past 20 years, the U.S. Secret Service National Threat Assessment Center (NTAC) has been conducting a 
unique blend of operationally relevant and behavior-based research on the prevention of targeted violence in 
various contexts, including attacks targeting public officials and public figures, government facilities, workplaces, 
public spaces, K-12 schools, and institutions of higher education. Targeted violence is a term coined by the Secret 
Service to refer to any incident of violence where an attacker selects a particular target prior to an attack. Through the 
Presidential Threat Protection Act of 2000, NTAC was congressionally authorized to conduct research, training, 
consultation, and information sharing on the prevention of targeted violence, and to provide guidance to law 
enforcement, government agencies, schools, and other public safety and security professionals. 


Threat assessment is the best practice for preventing incidents of targeted violence. It is an investigative approach 


pioneered by the Secret Service, originally developed as a 
when conducted by the Secret Service, involves identifying 
individuals who have a concerning or threatening interest 
in the President of the United States or another protected 
person, conducting an investigation to assess whether or 
not that individual poses a risk of violence or other 
unwanted outcome, and then taking steps to manage that 
risk. These cases receive the highest priority of all Secret 
Service investigations, and the agency considers these 
investigations to be as important as the physical security 
measures it employs. 

The Secret Service’s threat assessment model has since 
been adapted to prevent other acts of targeted violence 
impacting communities across the United States. These 
attacks have a profound and devastating impact on those 
directly affected and the Nation as a whole, none more so 
than attacks at K-12 schools. 2 Following the tragedy at 
Columbine High School in 1999, the Secret Service 
partnered with the U.S. Department of Education on a 
study that examined 37 incidents of targeted school 
violence that occurred from 1974 to 2000. The Safe 
School Initiative focused on gathering and analyzing 
information about the thinking and behavior displayed by 
the students who committed these violent acts. 3 The 
publication of the final report and accompanying guide 
provided schools and law enforcement with a framework 
for how to identify, assess, and manage students who 
display such threatening or concerning behavior. 


means to prevent assassinations. A threat assessment, 

Key Findings from the Safe School Initiative 
( 2002 ) 

• Incidents of targeted violence at school rarely were 
sudden or impulsive acts. 

• Prior to most incidents, other people knew about the 
attacker's idea and/or plan to attack. 

• Most attackers did not threaten their targets directly 
prior to advancing the attack. 

• There is no accurate or useful “profile” of students 
who engaged in targeted school violence. 

• Most attackers engaged in some behavior prior to the 
incident that caused others concern or indicated a 
need for help. 

• Most attackers had difficulty coping with significant 
losses or personal failures. Moreover , many had 
considered or attempted suicide. 

• Many attackers felt bullied , persecuted , or injured by 
others prior to the attack. 

• Most attackers had access to and had used weapons 
prior to the attack. 

• Most attackers demonstrated some interest in 
violence , through movies , video games , books , or 
other media. 

• Most attackers had no history of prior violent or 
criminal behavior. 

• In many cases , other students were involved in some 
capacity. 

• Despite prompt law enforcement responses , most 
attacks were stopped by means other than law 
enforcement intervention. 
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Since the release of the study in 2002, the findings of the Safe School Initiative have informed the targeted violence 
prevention efforts of schools and law enforcement across the country. To date, NTAC has delivered over 500 trainings 
on K-12 school threat assessment to over 100,000 school personnel, law enforcement, mental health professionals, 
and others with school safety responsibilities. NTAC has further consulted with individual schools and school districts, 
as well as county and state governments, as they developed threat assessment protocols geared toward proactively 
preventing these tragedies. 

There is more work to be done. 

In 2018, two incidents of targeted school violence alone resulted in the tragic loss of 27 students and staff, and 
serious injuries to 30 more. The February 14, 2018 attack at Marjory Stoneman Douglas High School in Parkland, FL 
and the May 18, 2018 attack at Santa Fe High School in Santa Fe, TX prompted school personnel, law enforcement, 
government agencies, and others to identify strategies for preventing future attacks. To support these efforts, NTAC 
initiated programs to provide updated research and guidance on threat assessment and the prevention of targeted 
school violence. 


The first phase involved the creation and distribution of an operational 
guide titled Enhancing School Safety Using a Threat Assessment 
Model: An Operational Guide for Preventing Targeted School 
Violence. Released in July 2018, the guide outlines actionable steps 
schools can take to create multidisciplinary threat assessment 
teams, establish central reporting mechanisms, identify student 
behaviors of concern, define the threshold for law enforcement 
intervention, promote safe school climates, and identify 
intervention and management strategies for decreasing the risk 
of a targeted attack. The guide is available on the Secret 
Service public website and was distributed to 40,000 public 
school districts and private schools across 
the country. 

The second phase was to conduct a new research study 
expanding on the Secret Service’s previous work in 
studying targeted school violence. The report that follows 
is the culmination of these efforts and represents the 
most in-depth analysis of targeted school violence to be 
conducted in decades. Protecting America's Schools: A 
U.S. Secret Service Analysis of Targeted School Violence 
examines 41 attacks against K-12 schools in the 
United States from 2008 to 2017. The report examines 
the background and behaviors of the attackers, in order to inform the best 
practices of multidisciplinary school threat assessment programs nationwide 
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Methodology 

Incident Identification 

NTAC researchers initiated a systematic review of relevant databases, publications, and public reports. The review 
sought to identify incidents of targeted school violence that occurred in the United States from 2008 to 2017. For 
this study, an incident of targeted school violence was defined as any incident in which (i) a current or recently former 4 
K-12 school student (ii) purposefully used a weapon (iii) to cause physical injury to, or the death of, at least one other 
student and/or school employee (iv) in or on the immediate property of the school (v) while targeting in advance one 
or more specific and/or random student(s) and/or employee(s). 

Certain exclusions were used in order to focus this project on incidents of targeted school violence. This study does 
not include attacks where a perpetrator could not be identified, or incidents related to gang violence, drug violence, or 
other incidents with a strong suggestion of a separate criminal nexus. Similarly, it does not include violence from the 
surrounding community that spilled onto school property by happenstance. It also excludes spontaneous acts, such 
as those that were the immediate result of an unplanned fight or other sudden confrontation. 

Because this project was initiated in early 2018, incident identification and collection was limited to cases that 
occurred through 2017, thereby allowing researchers to gather the most comprehensive case information for each 
incident. For this reason, the tragedies that have occurred in 2018 and 2019 were not able to be included in 
the analysis. 

Based on the stated criteria, researchers identified 41 incidents of targeted school violence, perpetrated by 41 current 
or recently former students, from January 2008 through December 2017. 

Case Information 

Information for the 41 identified incidents was drawn largely from primary source materials obtained by researchers 
related to the incident. Secret Service Field Offices across the United States worked with their local law enforcement 
partners to acquire investigative case files for 36 of the 41 incidents. These files included police investigative records, 
publicly available court records, and other publicly available information. These source materials may have also 
contained school records and mental health records. Obtained records included interviews with the attackers, 
interviews with witnesses and people who knew the attackers, school transcripts and disciplinary histories, social 
media screen captures, data from the searches of phones and computers used by the attackers, the results of 
searches of the attackers’ residences, personal journals and other writings, and court records containing the results 
of mental health evaluations both before and after the attacks. All case examples used in the drafting of this report 
were vetted through the agencies who provide the investigative files. Case analysis was further supplemented through 
a rigorous, structured review of open source information, including news articles and reports from government and 
private agencies. NTAC staff considered all available qualitative information to develop data relevant to threat 
assessment and prevention factors for each case. Some data were analyzed and are reported here for all 41 cases, 
including information on how the attacks were executed, school information, and demographic information about the 
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attackers. Information on the behavioral histories of the attackers, however, were only analyzed for 35 of the 41 cases 
due to the limited information available on the backgrounds of 6 of the attackers. 

Multiple layers of review were applied to every stage of the project to ensure accuracy and reliability of 
reported findings. 
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PART I: OVERVIEW OF THE ATTACKS 

School & Community Information 


SCHOOL TYPES: All but two of the attacks occurred in public schools (n = 39, 95%). Nearly three-quarters of the 
attacks were carried out at high schools (n = 30, 73%), which are defined in this report as any school that reaches 
12th grade. Nine attacks took place at middle schools (22%), and one attack occurred at an elementary school (2%). 
One additional attack occurred at a K-ll 
school (2%). 


SCHOOLTYPE 


COMMUNITIES: Approximately one-third (n = 14, 
34%) of the attacks occurred in schools located in 
suburban communities, while 11 attacks occurred 
in cities (27%). Ten incidents were carried out in 
rural schools (24%), and the fewest attacks took 
place in small towns (n = 6,15%). 5 


Other School 2% 
Elementary School 2% 


Student Enrollment 

< 500 

9 

22% 

500 - 999 

15 

37% 

1000 -1499 

8 

20% 

1500+ 

9 

22% 

Percentages may not total 100 due to rounding. 



Percentages may not total 100 due to rounding. 

SCHOOL SIZE: Over half (n = 24, 59%) of the attacks took place at 
schools with fewer than 1,000 students, and 17 (41%) occurred at 
schools with 1,000 students or more. Over one-third of the attacks took 
place at schools with between 500 and 999 students (n = 15, 37%). 


CLASS SIZE: Teacher to pupil ratios also varied among the impacted 
schools, with eight of the schools (20%) at the national average of 1:15 
to 1:16. One-third (n = 13, 32%) had lower ratios than the average, and 
20 schools (49%) had higher ratios. The highest ratio was 1 teacher for 
every 26 students. 7 


Teacher to Pupil Ratios 

1:9 to 1:14 

13 

32% 

1:15 to 1:16* 6 

8 

20% 

1:17 to 1:19 

9 

22% 

1:20 to 1:26 

11 

27% 

* National average 

Percentages may not total 100 due to rounding. 
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School Security & Prevention Measures 

Most of the schools (n = 33, 80%) in this study implemented some type of physical security measure , and two-thirds 
(n = 27, 66%) had full- or part-time school resource officers (SROs) on campus. 


PHYSICAL SECURITY MEASURES: The most frequently used physical security measure was school lockdown 
procedures, present in at least 28 (68%) of the schools where an attack took place. Fourteen (34%) schools had 
security cameras, which were located either inside or outside of the 
schools. Seven (17%) had alert systems, which were used to notify 
members of the school community of emergencies via automated 
text messages or phone calls. Three (7%) schools had 
magnetometers, but they were not regularly used. Six (15%) schools 
employed private security guards, who were usually unarmed. 


Physical Security and 
Threat Assessment 


SCHOOL RESOURCE OFFICERS: At the time of the attacks, nearly 
half of the schools (n = 19, 46%) had one or more full-time SROs. 

An additional eight schools (20%) had an SRO who operated at the 
school part-time, because they were assigned to multiple schools 
within the district. 

REPORTING TOOLS: Only seven (17%) schools had any type of 
system in place to notify school staff or administrators of 
threatening or concerning student behaviors before an attack. 

These systems usually involved a phone number, email address, or 
a paper referral through which the school could be contacted. At the 
time of the incidents, few states had 
implemented comprehensive statewide reporting 
programs, like Safe2Tell™ Colorado. 


When the Safe School Initiative was published in 2002, 
it stated that “the Secret Service considers threat 
assessment to be as important to preventing targeted 
violence as the physical measures it employs." The 
Secret Service protects our Nation's highest elected 
officials using physical security measures in 
conjunction with, and complimented by, a threat 
assessment approach designed to proactively 
intervene with those individuals who intend to cause 
harm. This complimentary approach to protection 
recognizes that either of the approaches, alone, would 
not constitute the most effective means of preventing 
an attack. 


Safe2Tell™ Colorado 


ASSESSMENT AND INTERVENTION PROTOCOLS: 

Nine (22%) schools had some type of program 
involving employees who were assigned to 
assess unwanted or potentially harmful student 
behavior. For some of these schools, they had 
developed basic protocols for assessing and 
responding to reports of a student threat. In 
others, school staff created more formal threat 
assessment teams, but the participation, 
training, and protocols of these teams varied. 
The Secret Service recommends that schools 
implement multidisciplinary school threat 


Safe2Tell is a statewide, anonymous reporting tool, which accepts tips 24/7 
regarding any concern of safety to self or others. Every tip is evaluated by 
Safe2Tell analysts at the Colorado Information Analysis Center (ClAC), then 
disseminated to schools and local law enforcement as appropriate. Built-in 
accountability ensures that every tip is responded to before a case can 
be closed. 

During the 2018-2019 school year, 19,861 tips were received by Safe2Tell. 
The most common tips received were related to student suicide, drug use, 
and bullying. 

For states that would like to implement this type of reporting program, 
Safe2Tell provides information and resources at: 

www.safe2tell.org 
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assessment teams in accordance with Enhancing School Safety Using a Threat Assessment Model: An Operational 
Guide for Preventing Targeted School Violence. This framework is intended to help schools develop the capacity to 
identify, assess, and manage students who are displaying concerning or threatening behaviors. This process should 
complement the physical security measures that a school determines is appropriate for its community. 


Weapons Used 


Most of the attackers (n = 25, 61%) used firearms, which included handguns, rifles, and 
shotguns. In total, attackers used 18 handguns and 9 long guns during the attacks, 
with two attackers using multiple firearms. The remainder (n = 16, 39%) used bladed 
weapons, which most frequently included pocket or folding knives, followed by butcher 
or kitchen knives, and hunting knives. In one instance, the attacker used a World War 
II bayonet. Three of the attackers used a combination of weapons to cause harm or 
damage, including one who used a knife and a claw hammer, another who used a knife 
and bo staff, and another who used a firearm and a Molotov cocktail. 


WEAPON USED* 



Three attackers also used another 
weapon including a hammer, a bo staff, 

Several of the attackers brought other weapons to the attack that they did not and a Molotov cocktail, 

ultimately use. Some brought knives in addition to the firearm or knife that was used, 

while others brought items ranging from a wrench wrapped in a bandana to home-made explosives. For example, one 
attacker who used a knife in his attack also brought five other knives, a blowtorch, three containers of flammable 
liquid, and firecrackers. 


Timing & Location 

TIMING OF THE ATTACK: The 41 attacks occurred with 
varying frequency from year to year and do not appear to 
be steadily increasing or decreasing. While these 
incidents comprise only some of the acts of violence 
that occur in K-12 schools each year, data from the CDC 
regarding all school associated violent deaths similarly 
does not show a steady increase or decrease. 8 


Incidents by Year 


5 A. 


6 

4 



3 

i i 





1 1 

1 H H 1 






2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 


Incidents in the current study took place in every month except July and 
occurred on every day of the week except Sunday. The one incident that 
occurred on a Saturday took place outside of a school prom. 
Three-quarters of the attacks were carried out before the school day 
began (n = 10, 24%) or during morning classroom hours (n = 21, 51%). 


Timing of the Attacks 


Before School .10 (24%) 

Morning Classroom Hours .20 (51%) 

During Lunch .3 (7%) 

Afternoon Classroom Hours . 6 (15%) 

Outside School Hours .1 (2%) 
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BREAKS IN ATTENDANCE: Incidents occurred most 
frequently at the start of the school year (Sep) or 
after students returned from winter break (Jan). 

Seventeen attacks (41%) took place within the 
first week back to school following a break in 
attendance, including suspensions, school 
holidays, or an absence due to illness or truancy. 

Nearly one quarter of the attacks (n = 10, 24%) 
took place on the first day that the attacker 
returned to school after an absence. In two of 
these incidents, the attacker was actively 
suspended from the school at the time of the 
attack. These findings suggest that schools should 
make concerted efforts to facilitate positive student engagement following discipline, including suspensions and 
expulsions, and especially within the first week that the student returns to school. 


Incidents Over Academic Year 


8 8 
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A 14-year-old student fatally stabbed a classmate at the middle school they both attended. At the time of the incident , the 
attacker was suspended for truancy. Despite the suspension , witnesses reported seeing him walking the school’s hallways in 
search of the target shortly before the stabbing took place. 


Four attacks (10%) occurred on the first day back from a regularly scheduled school holiday. Of those, three took place 
on the first day following an extended break, including the summer, fall, and winter holidays. 


A 15-year-old student shot and wounded a random classmate in the high school cafeteria 
on the first day of the school year. The attacker had planned the attack over the last week 
of his summer break. On the morning of the incident , he shared a message on social media 
stating , “First day of school, last day of my life.” The shooting took place four hours later. 

DURATION OF THE ATTACKS: Most of the attacks (n = 34, 83%) lasted five minutes 
or less. Two-thirds of the incidents (n = 28, 68%) lasted for two minutes or less, and 

nearly half of the attacks (n = 18, 44%) ended within one minute. Only six of the 

attacks (15%) lasted longer than five minutes, and none of the attacks lasted longer 
than 15 minutes. 9 


DURATION OFTHEATTACKS 



LOCATION OF THE ATTACKS: The attacks usually started and ended 
in the same location (n = 36, 88%). The most common locations of 
attacks were in classrooms and immediately outside of the school. 
Other locations included cafeterias, hallways, and administrative 
offices. Attacks in restrooms, locker rooms, a gymnasium, and a 
vestibule were less common. 


Percentages may not total 100 due to rounding. 


Locations of the Attacks 


Classroom Outside 
Cafeteria Hallway 
Locker Room Gym 


Office 

Restroom 

Vestibule 
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Response Times 

SCHOOL OFFICERS: In 27 cases (66%), a security officer or SRO was assigned to the school on either a full- or part- 
time basis. During 20 of the attacks (49%), the officer was on duty at the school. In over one-quarter of the cases 
(n = 12, 29%), the officer or SRO was able to make it to the scene of the attack within one minute. In three of the 
attacks (7%), it took between one and five minutes for the officer to respond, and for two attacks (5%), it took between 
five and ten minutes. Of note, in two cases the officers themselves were the targets of the attacks, and in the 
remaining, it was not possible to determine the response time based on information that was available. 

OUTSIDE LAW ENFORCEMENT: In just over one-third of the attacks (n = 16, 39%), outside law enforcement were 
notified within one minute or less from the start of the attack, and in just under one-third (n = 12, 29%), outside police 
were notified between one and five minutes after the start of the attack. In nine cases, it took longer than five minutes 
for someone to notify outside law enforcement, and in four cases the timing could not be determined from 
information available. 

In nearly one-third of the cases (n = 13, 32%), it took external first responders between one and five minutes to arrive 
on scene after the attack was initiated, and in about a quarter of the cases (n = 11, 27%) first responders arrived 
between five and ten minutes after the attack began. In only one case, outside law enforcement were able to respond 
in one minute or less, because officers were already at the school conducting K-9 drug sweeps at the time of 
the attack. 



School Officer 
Response 
Time * 

Outside LE 
Notification 

Outside LE 
Response 
Time 

1 min or less 

12 (29%) 

16 (39%) 

1 (2%) 

>1 to 5 min 

3 (7%) 

12 (29%) 

13 (32%) 

>5 to 10 min 

2 (5%) 

4 (10%) 

11 (27%) 

>10 to 15 min 

— 

5 (12%) 

4 (10%) 

>15 min 

— 

— 

3 (7%) 

Not Applicable 

21 (51%)** 

— 

— 

Not Found 

3 (7%) 

4 (10%) 

9 (22%) 

*Percentages may not equal 100 due to rounding 

** Includes those schools without officers assingned, assigned officers off 

duty at the time, or cases in which the SROs were targeted. 

_ 



United States Secret Service 

NATIONAL THREAT ASSESSMENT CENTER 



Resolution & Harm 

ATTACK RESOLUTION: Half of the attackers (n = 21, 51%) ended the attack without any external intervention. Seven 
attackers (17%) committed suicide, six (15%) left the scene, three (7%) surrendered to a school official(s), three (7%) 
dropped their weapons and waited to be arrested, one (2%) stopped and called family, and one attacker (2%) left the 
scene before calling family. 

Non-law enforcement adult school staff brought nine attacks (22%) to an end. This included teachers, guidance 
counselors, an assistant principal, a sports coach, a campus supervisor, and a janitor. Six of the attacks (15%) were 
ended with law enforcement intervention, either by SROs (n = 5,12%) or by local police who were already on campus 
(n = 1, 2%). Two of the attackers were killed by the law enforcement response. No attacks were ended by outside law 
enforcement agencies responding to the scene from off campus. Other attacks ended due to student bystander 
intervention (n = 4,10%) or a weapon malfunction (n = 1, 2%). 

HARM: Ninety-eight victims were harmed in the 41 attacks, including 79 injured 
and 19 killed. The victims included students, school staff, and law enforcement. 10 
One stabbing incident accounted for 20 of the 98 victims, all of whom were injured 
but survived. In just over half of the attacks (n = 22, 54%), only one individual was 
harmed. In the remaining attacks, two persons were harmed (n = 9, 22%), or three 
or more were harmed (n = 10, 24%). 

TWENTY VICTIMS: A 16-year-old student randomly slashed and stabbed people at his high 
school using two kitchen knives he had brought from home. Nineteen students and one 
staff member were injured, but all survived. The attack ended after about five minutes 
when the assistant principal tackled the assailant. 


PERSONS INJURED OR KILLED 

Law Enforcement 
2 % 



Mass Attacks 

The definition of a "mass attack/ 7 as used by the U.S. Secret Service in its Mass Attacks in Public Spaces report series, 
includes harm (e.g., injury or death) to three or more persons, not including the attacker. About one-quarter of attacks 
(n = 10, 24%) in this study would meet that definition of a mass attack. 
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Judicial Outcome 


CRIMINAL CHARGES: Thirty-two attackers (78%) were criminally charged, 
twenty-two of whom (54%) were charged as adults. Nearly all of those 
charged as adults accepted plea agreements (17 pled guilty; 2 pled no 
contest). Only two cases went to trial, where both attackers were found 
guilty and sentenced as adults. A third attacker is still awaiting trial in 
adult court. 

Twelve attackers were processed through the juvenile justice system. 

Of those charged as juveniles, the majority pled to their charges (9 pled 
guilty; 1 pled no contest). 

CURRENT DISPOSITIONS : Twenty-two of the attackers (54%) are 
currently incarcerated, and one attacker is a patient at a mental health 
facility. Eight attackers (20%) have been released from juvenile and/or 
adult correctional institutions. 11 


Judicial Actions 

Adult 

22 

54% 

Subject pled guilty 

17 

41% 

Subject found guilty 

2 

5% 

Subject pled 
no contest 

2 

5% 

Charges filed, 
case pending 

1 

2% 

Juvenile 

12 

29% 

Subject pled guilty 

9 

22% 

Unknown 

2 

5% 

Subject pled 
no contest 

1 

2% 

No Charges Filed 

9 

22% 

Subject committed 
suicide 

7 

17% 

Subject fatally shot 

2 

5% 

Percentages exceed 100 as two attackers had both adult and 
juvenile charges. 
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PART II: THE ATTACKERS 


GENDER , RACE , & AGE: While the attackers were predominantly male (n = 34, 83%), seven of the attackers were fe¬ 
male (17%). Based on police report designations, approximately two-thirds of the attackers (n m 26, 63%) were White, 
six were Black (15%), and two were Hispanic (5%). Their ages ranged from 12 to 18, with an average age of 15. 


YOUNGEST: A 12-year-old student opened fire at his middle school. He killed one teacher and injured 
two classmates before fatally shooting himself. The attacker had a history of being bullied and felt 
mistreated by students and teachers. 

OLDEST: An 18-year-old former student , who had graduated the year prior , opened fire outside of his 
old high school toward a group of students exiting the prom. Two of the students were shot and 
injured. Local police were already on scene conducting drug sweeps , and instructed the attacker to 
drop his weapon. When the attacker failed to comply with police instructions , he was fatally shot by 
one of the officers. The attacker believed that his ex-girlfriend and her new boyfriend were attending 
the prom together , but neither was actually in attendance. 


GENDER 



Race 

White 

26 

63% 

Black/African American 

6 

15% 

Hispanic 

2 

5% 

American Indian or Alaska Native 

1 

2% 

Two or More Races 

4 

10% 

Undetermined 

2 

5% 

Categories consistent with the U.S. Department of Education guidance on the 
collection & Reporting of racial & ethnic data. (72 Fed. Reg. 59267 Pub. Oct 2002.) 


GRADE LEVEL: The grade levels of the attackers 
ranged from 7th grade to 12th grade. 


FORMER STUDENTS: Four of the attackers (10%) 
targeted schools in which they were no longer 
enrolled as students. They included a student who 
attacked his former high school after transferring 
to an alternative school; a student whose mother 
withdrew him from school because he was about to be expelled; a student who had graduated the previous year, but 
was working at the school as a teacher’s assistant and occasionally performed with the school marching band; and a 
middle school student who attacked his former elementary school. 


Grade level of the Attackers 



7th 8th 9th 10th 11th 12th Former Unknown 

Student 
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Motives 

When determining motives, all available information about each attacker's thinking and behavior in the time leading 
up to the attack was considered, including explicit explanations of motive that the attackers provided through verbal 
statements made before the attack, in suicide notes or manifestos, and during post-incident interviews with 
law enforcement. 

Consistent with other forms of targeted violence, the motives behind these 41 school attacks varied widely and were 
based on the personal perceptions and experiences of the attackers. Most attackers had multiple motivations for 
carrying out their attacks. This analysis indicates that a student’s motive to carry out a violent act at school is 
usually multifaceted and is the byproduct of the student’s individual circumstances, as well as their personal 
perception of those circumstances. 


Components to Motive 13 

Primary 

Secondary 

Total 

Grievances 

25 (61%) 

9 (22%) 

34 (83%) 

Peers 

15 (37%) 

11 (27%) 

26 (63%) 

Related to bullying 

- 

- 

19 (46%) 

Staff 

4 (10%) 

6 (15%) 

10 (24%) 

Romantic 

4 (10%) 

5 (12%) 

9 (22%) 

Other personal 

2 (5%) 

4 (10%) 

6 (15%) 

Desire to kill 

7(17%) 

8 (20%) 

15 (37%) 

Suicidal 

3 (7%) 

14 (34%) 

17 (41%) 

Fame/Notoriety 

2 (5%) 

2 (5%) 

4 (10%) 

Psychotic symptoms 

2 (5%) 

3 (7%) 

5 (12%) 

Unknown 

2 (5%) 

n/a 

2 (5%) 

Total 

41 (100%) 




All but two of the 41 attackers had an identifiable primary motive, defined as the motive that appeared to most 
strongly contribute to the attacker’s decision to act violently. Most of the attackers (n = 35, 85%), however, had at 
least one additional secondary motive that contributed to their decision for carrying out the attack. 

SINGLE MOTIVE: A recently suspended 14-year-old student fatally stabbed a classmate in the chest as he exited his middle 
school. The students had been friends, but due to frequent conflicts, their relationship had deteriorated. The victim of the 
stabbing had previously threatened, harassed, and bullied the attacker. The attacker grew to fear for his life and stopped 
attending school in order to avoid the victim, which led to the attacker’s suspension for missing class. The attacker later 
reported that he had been motivated by fear ; stating that if he had not returned to school to stab his classmate, he believed 
that he would have been killed himself. 
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MULTIPLE MOTIVES: An 18-year-old student shot and killed a classmate he encountered immediately upon entering his school. 

He then sought out the debate team coach, who escaped, before the attacker killed himself. The attacker appeared to have been 
primarily motivated by a grievance with the debate team coach, who had removed him from a captain position on the debate 
team. Additional motivations appeared to include grievances with other staff members and classmates, a sadistic desire to hurt 
other people, and suicidal ideations. 

GRIEVANCES: For most of the attackers (n = 34, 83%), retaliating for a grievance played a role in their motive. For 
nearly two-thirds of the attackers (n = 25, 61%), it appeared to be their primary motive. 

• Peers: Most frequently, grievances involved classmates (n = 26, 63%), and these peer grievances were usually 
related to bullying in some way (n = 19, 46%). Other examples of peer grievances that did not involve bullying 
included ongoing conflicts and contentious relationships between students, or anger over a specific event or 
situation among classmates. 

A 14-year-old student fatally shot a classmate at his middle school. The victim had been the subject of harassment by the 
attacker and other students, who would call the victim derogatory homophobic names. The attacker later reported that the 
victim had made comments that made him uncomfortable, citing them as "the final straw” in his decision to attack. 

• Staff: In a quarter of the attacks, the attacker had a grievance that involved school staff (n = 10, 24%). For 

four attackers (10%), this grievance with teachers or administrators was the primary motivation. In each of those 
four incidents, the school staff members were specifically targeted in the attack. 

A 16-year-old student fatally stabbed his high school principal. According to his confession after the incident, the attacker 
began planning his attack on the principal three months earlier, after he learned that he would be returning to the same high 
school for 11th grade. He stated that the school principal made him the most angry, and he " didn't like the school and didn’t 
want to attend there anymore.” He was also angry at having to follow school rules, for example, when the principal repeatedly 
made him tuck in his shirt. 

• Romantic: Nine cases (22%) involved a grievance related to a romantic relationship as a primary or secondary 
motive. Two of these cases involved female attackers, while seven involved male attackers. 

A 15-year-old student fatally shot a former romantic partner outside of their high school before committing suicide. The 
students had dated for over two years, but the victim had recently informed the attacker that the relationship was ending. 
According to media reports, the attacker also had a history of suicidal ideations and depressive symptoms. In redacted 
versions of the notes released publicly, the attacker expressed anger at the victim for wasting the attacker’s money, time, 
affection, and "so much more.” The attacker also wrote, "we planned our future together," adding, "This week has been the 
worst in my life," and, "All of this has destabilized me." 
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• Other Personal Issues: Six students (15%) were motivated by other personal issues, and for two (5%), it was their 
primary motive. These personal issues involved things like anger over a failed drug test at school and retaliating for 
abuse or neglect occurring at home. 

A 14-year-old student opened fire toward random classmates in his high school cafeteria. Two students were shot 
and injured, and two other students received minor injuries , possibly when struck by shrapnel. The attacker later 
stated his motive was attributed to his troubled home life , including a distant relationship with his mother , conflicts 
with his father ; and an addiction to Adderall. 

DESIRE TO KILL: The second most prevalent motive among student attackers (n = 15, 37%) was a desire to kill, 
evidenced by a sadistic interest in violence or violent topics, a desire for power over their victims, or the expectation 
of joy or pleasure in causing physical harm to others. For seven attackers (17%), this appeared to be their primary 
motive, and eight additional students (20%) experienced these types of thoughts as a secondary motive. Nearly all 
attackers were primarily motivated by a desire to kill targeted random victims (see Appendix A: Statistical Analyses). 
While it is possible that a desire to kill could be associated with psychological symptoms, it more often appeared to 
develop as a response to the student’s personal circumstances and life experiences. 

A 15-year-old student fatally shot a classmate at his high school. The attacker had been in previous conflicts with the victim , 
but he also displayed a fascination with causing physical harm to others. A few days before the attack , the attacker showed 
a handgun and ammunition to classmates , highlighting that“these bullets bounce around inside of your body.” He was also 
overheard saying that he was interested in seeing what it felt like to kill someone. During his subsequent trial , a clinical 
psychologist said that the attacker had been '‘born to violent addicts , shoved into abusive foster homes , and largely ignored 
by courts and caseworkers.” 

SUICIDAL: Seventeen attackers (41%) were motivated by suicide to carry out their attacks. For three attackers (7%), 
this appeared to be their primary motive, only one of whom appeared to be motivated by suicide alone. An additional 
14 attackers (34%) had suicidality as a secondary motive. These findings reveal that suicidal ideations were rarely the 
sole or primary factor in an attacker’s motivation for violence. Suicidal ideations were more typically found in 
combination with, and secondary to, other motives. 


A 16-year-old student intended to commit suicide-by-cop when he stabbed 
his SRO seven times with a bayonet. The officer struggled with the 
attacker before fatally shooting him in self-defense. The attacker’s final 
words to the officer were , “Thank you sir , thank you.” In a suicide note , the 
attacker described human civilization as an “unnatural system” and 
included additional language like , “if you’re reading this , I’m either dead or 
on my way to dying. If I fail at suicide , something else will end me. I have 
had enough of this tainted and corrupted world we live in” and , “I hope for 
a better existence after my passing.” 


Youth Suicide 

In 2017, the CDC reported suicide as the 2nd 
leading cause of death among those between the 
ages of 10-24 years old. 

The National Suicide Prevention Lifeline provides 
free and confidential 24/7 support to people in 
crisis. If you or someone you know needs help , call 
1-800-273-TALK (8255). 
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FAME/NOTORIETY: Four students (10%) were motivated by a desire for fame or notoriety as a primary or secondary 
motive. Each of these four students expressed a desire to emulate previous mass attackers, including those who 
perpetrated the attacks at Columbine High School, Virginia Tech, and Sandy Flook Elementary School. 

A 14-year-old student opened fire at his SRO in an effort to steal the officer’s weapon. He intended to use the 
officer’s firearm to perpetrate a mass shooting at his high school. The officer was burned by the discharging firearm , but was 
able to detain the student before further harm occurred. Three months prior ; the attacker began keeping an extensive journal 
about his plans , in which he described his research into the attacks at Columbine High School and Virginia Tech. He wrote 
about his desire to be “worshipped” like previous attackers , adding , “I hope to out-do my idols and leave my mark on the 
world.” He wrote about how he hoped that security camera footage of his attack would be on YouTube for his “followers” to 
study. After the attack , while in juvenile detention , the student continued to express interest in the media coverage of his 
attack , asking staff at the detention center if he could read the comments posted by readers of the online news articles. 

PSYCHOTIC SYMPTOMS: Five students (12%) appeared to be motivated by psychotic symptoms, either as a primary 
or secondary motive. These cases involved such symptoms as auditory hallucinations instructing the student to hurt 
people, compulsive homicidal thoughts and visions, and a delusional belief that the student was in a romantic 
relationship with a classmate. 

A 15-year-old student randomly stabbed two classmates in a high school restroom. Both victims survived the attack. The 
attacker had a history of homicidal and suicidal thoughts , thoughts of violence towards her family and girls at school, and had 
previously threatened to stab a friend’s boyfriend. According to court records , six months prior to the attack , she was admitted 
to an outpatient hospitalization program for her mental health. One counselor asked the attacker if she had suicidal or 
homicidal ideations , and she responded , “Sometimes I get really sick thoughts. Sick ways of killing them , stabbing them , 
slitting their throats , sexually abusing people at school.” 

Targeting 

In all forms of targeted violence, the targeted person or persons are usually selected by the attacker in relation to his 
or her motive. For example, if an attacker has a grievance with a specific person or group, they may target that person 
or group during the attack. In many of those cases, however, additional bystanders may be injured or killed, either as 
unintended collateral victims or as victims of opportunity. In other instances, the attacker may indiscriminately target a 
population of people, like the entire student body at a school, depending on the attacker’s goals and motives. 

SPECIFIC PERSON TARGETED: In nearly three-quarters of the attacks (n = 30, 73%), a specific person or persons were 
targeted by the attacker. In 22 attacks (54%), a specifically targeted person was injured or killed. 

A 12-year-old student stabbed her middle school classmate in the neck and stomach , injuring him. Other students had 
previously observed the victim teasing the attacker and calling her names. A few days before the incident, the attacker told 
another student that she hated the target. Just minutes before the stabbing , the attacker told a group of classmates that she 
hated the target and that she wanted to kill him , because he was annoying and was a bad person. Nobody else was targeted 
or harmed in the attack. 
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SPECIFIC GROUP TARGETED: In six attacks (15%), a specific group of students was targeted (e.g. f bullies, “jocks,” 
“emos,” “preps,” “sinners”). In only one of those attacks was a member of the targeted group actually harmed. 

A 17-year-old former student opened fire in his previous high school cafeteria toward a group of students who had bullied him. 
The attacker was in his previous high school because he would arrive there each morning before being bused to an alternative 
school. Three students were killed and three more were injured. Those killed had all reportedly bullied the attacker ; and one of 
them was dating the attacker’s ex-girlfriend. One of the injured students had also bullied the attacker ; but the two other injured 
students were bystanders. 

RANDOM VICTIMS: Seventeen attacks (41%) involved random victims who were attacked indiscriminately or 
opportunistically by the attacker (e.g., the attacker fired into a crowd or fired upon the first student he saw). 

A 16-year-old student randomly attacked a female classmate with a serrated knife and a claw hammer when she walked into 
the high school restroom. The victim was stabbed and hit several times, but survived the attack. The attacker’s motive was 
to kill as many people as she could before fleeing the school. She then planned to purchase a gun and commit suicide. 


COLLATERAL VICTIMS: Five attacks (12%) involved random victims who were injured as collateral bystanders (e.g., the 
attacker aimed at a specific target, but an unintended student was shot). 
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Planning 


Over half of the attackers (n = 21, 51%) engaged in observable planning behaviors prior to carrying out their attack 
that went beyond making statements of intent. Twelve attackers (29%) exhibited three or more different types of 
planning activities that were observable to others. Of note, the attackers in this study who perpetrated mass attacks 
averaged more than twice as many planning behaviors as attackers with fewer victims (see Appendix B: Statistical 
Analyses). For 10 of the attackers (24%), their first act of planning was within one month of the incident. Seven 
attackers (17%) began planning between one and six months before the attack, and rarely did planning begin more 
than six months prior (n = 3, 7%). 13 While some attackers discussed their plans with others, no attackers appeared to 
receive direct assistance in planning their specific school attack. 


WEAPONS RESEARCH AND SELECTION: One-third of the attackers 
(n = 13, 32%) researched weapons prior to the attack. This 
included conducting online searches, reading books and 
pamphlets, or asking others about weapons experience and other 
related topics. The research focused on how to make explosives, 
weapon functionality and utility, how to inflict maximum damage, 
and types of protective equipment. 

DECEPTIVE PRACTICES: Nine attackers (22%) engaged in deceptive 
practices in order to hide their activities and avoid detection. This 
included lying about weapons purchases and other materials (e.g., 
telling parents that purchased materials were for chemistry class), 
concealing weapons for transport, claiming needing a weapon 


Planning for the Attack 


Weapons Research 
and Selection 

Deceptive Practices 

Weapons-related 

Documentation of 
Plans 

Approaching, 
Surveilling, or 
Researching the 
Target 


Planning the 
Execution of the 
Attack 

Practicing with a 
Weapon 

Recruiting Others 

Packing an Attack 
Bag 

Researching Prior 
Attacks 


for protection, or waiting until after dark to manufacture weapons. For example, on the night prior to one attack, the 


attacker waited until his mother went to sleep before building homemade explosives. Fie then pretended to be asleep 


so that his mother could wake him up to start the day, thus maintaining their normal routine and not arousing 


any suspicion. 


WEAPONS-RELATED: Seven attackers (17%) engaged in weapons-related planning behaviors, in addition to weapons 
research (see Weapons Research and Selection) and the acquisition of the weapons used in the attack (see Firearm 
Acquisition section). These other activities included manufacturing explosives, modifying guns or knives, stockpiling 
additional weapons, or failed attempts to acquire other weapons. Some who failed to acquire certain weapons or 
materials adjusted their plans to use other weapons already acquired or more readily accessible. 


A 12-year-old student shot and wounded several classmates and a school security officer in his middle school gymnasium 
before surrendering to a teacher. Two days prior to the incident, the attacker had attempted to acquire his father’s handgun, 
but was unsuccessful. Then the night before the attack, he took a shotgun from his home and sawed off the barrel so that it 
could fit into his duffel bag. 
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DOCUMENTATION OF PLANS: Seven attackers (17%) documented their plans and intentions for the attack in journal 
entries or other writings. These writings included hit lists, safe lists (e.g., lists of those individuals who would not be 
targeted), supply lists, lessons learned from past attackers, and diagrams of school hallways. 

A 15-year old student fatally shot a classmate and injured three others at his high school, before surrendering to the school 
janitor. In his journal and other scattered writings, police found diagrams mapping his high school, along with written 
homicidal statements and lists of chemicals, weapons, and ammunition. The attacker had also written “X Kill” on the photo 
page in his yearbook and had crossed out the photographs of 26 classmates. 

APPROACHING , SURVEILLING, OR RESEARCHING THE TARGET: Five of the attackers (12%) researched their targets 
prior to the attack. This included surveilling the SRO in order to learn his routine, noting security camera locations, 
and trying to arrange meetings with a targeted teacher. 

A 14-year-old student shot and killed his father before driving to his former elementary school, where he opened fire near the 
playground. One elementary student was fatally shot, and at least one other student and one teacher were injured. The 
attacker had researched the schedules of schools he had attended and inquired about security and the presence of SROs. He 
chose to target his former elementary school due to the more robust security at his middle school, his understanding of police 
response times to different schools, and the proximity of the elementary school to his home. 

PLANNING THE EXECUTION OF THE ATTACK: Five of the attackers (12%) spent time carefully considering how they 
would execute their attacks. They considered the “best” location to kill their intended target(s), the class period to 
initiate the attack, and the route they would take through the school. One of the attackers shared his plan via 
social media. 

RESEARCHING PRIOR ATTACKS: Five of the attackers (12%) conducted research on prior incidents of targeted 
violence, including past school attacks. This research was usually conducted through online searches, or by 
watching videos or documentaries of prior attacks. 

A 16-year-old student used two kitchen knives to slash and stab 19 classmates and a school security guard. The attacker 
selected the birthday of one of the Columbine attackers as the date of his attack. Prior to the incident, the attacker had 
watched a documentary about the Columbine shooting in an effort to "numb himselfin preparation for his planned attack. 

PRACTICING WITH A WEAPON: Four attackers (10%) practiced with a weapon prior to their attack. This included one 
attacker who tested his homemade pipe bombs, one who practiced loading and unloading a shotgun, and one who 
practiced wearing tactical gear. 

RECRUITING OTHERS: Four attackers (10%) contemplated or attempted recruiting others to help execute the acts of 
violence. Two of these attackers attempted unsuccessfully to recruit a specific individual to assist with the attack. 
Two others considered recruiting help, but did not. One of those attackers realized that attempts for recruitment 
could make him vulnerable to detection and therefore refrained from asking. 


21 


PROTECTING AMERICA’S SCHOOLS/ ANALYSIS OF TARGETED SCHOOL VIOLENCE/2019 


United States Secret Service 

NATIONAL THREAT ASSESSMENT CENTER 



PACKING AN ATTACK BAG: Two attackers (5%) packed a supply bag prior to the incident. One of them packed 
clothes, cash, and other items needed to run away from home after the attack, and the other packed additional 
weapons, an energy drink, and a lollipop. 

OTHER TYPES OF PLANNING: Nine attackers (22%) took steps to plan their attack in ways that were unique and 
could not be categorized among the other behaviors. This included stealing money to buy weapons, deleting an 
email account, and specifically wearing baggy pants the day of the attack in order to conceal a weapon. 

Firearm Acquisition 

The primary weapons used in the 41 attacks were firearms (n = 25, 61%) and knives (n m 16, 39%). In most of the 
incidents involving knives, the weapons were taken by the attacker from their kitchens or other areas of their homes. 
Because knives are commonly available with little restriction, this section focuses on how the attackers acquired the 
firearms used in the attacks. All percentages provided in this section are based on the 25 attackers who 
used firearms. 


FROM THE HOME: Nineteen attackers (76%) acquired a firearm from the home of a parent or another close relative. In 

half of the firearms cases (n = 12, 48%), evidence indicates the firearm was either readily accessible, or it was not 
secured in a meaningful way. For example, some firearms had been kept locked in accessible wooden or glass cabi¬ 
nets, locked in vehicles, or hidden in closets. In four cases (16%), the firearms were kept in more secured locations, 
but the attacker was still able to gain access to them. In these instances, the firearms were secured in a locked gun 
safe or case, but the attackers were able to gain access to them because they knew the combination or where the 
keys were kept, or they were able to guess the password or combination. In 

three cases, it is unknown if the firearm had been secured. Juvenile Access to Weapons 


A 15-year-old student fatally shot one classmate and injured three others at 
his high school. The attacker knew the combination to his father’s gun safe, 
from which he was able to obtain a loaded semi-automatic .223-caliber AR-15 
rifle with a 30-round magazine, and a .32-caliber semi-automatic pistol. The 
attacker transported the weapons on the school bus by concealing the rifle and 
seven extra boxes of ammunition in a golf bag. He kept the handgun in 
his pocket 

TIMING OF THE ACQUISITION: Eight of the attackers (32%) acquired a firearm 
on the day of the attack. Five additional attackers (20%) acquired a firearm 
the day before the attack, and four attackers (16%) acquired a firearm 
between two and seven days prior. This finding reinforces the importance 
of a swift response to situations involving students who may pose a risk of 
harm to themselves or others, especially those who have access to 
weapons in the home. 


Under federal law, individuals under the age 
of 18 may not legally possess a handgun, 
except in limited circumstances. 
Federal law does not restrict the age of 
individuals who may possess long guns 
(e.g., shotguns and rifles). Some states 
have implemented additional restrictions on 
juvenile possession of firearms, for example, 
prohibiting minors from possessing any 
firearm, except for certain activities and with 
parental consent. 14 

If a child poses a risk of harm to him/herself 
or others, it is the responsibility of parents, 
law enforcement, and schools to 
collaboratively determine the most 
appropriate avenue for ensuring that the 
child does not have access to weapons. 
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WEAPONS TRANSPORT: Half of the attackers (n = 12, 48%) who used a firearm in their attack transported the weapon 
into the school building while concealed in their backpacks. Three attackers (12%) transported their firearms into the 
school in another type of bag, including a guitar case, a golf bag, or a gym bag. One attacker transported a firearm 
into the school concealed in his waistband. Two attackers did not conceal their firearm, carrying it openly into the 
school building after the start of the school day. 

Additionally, two attackers transported firearms from home to school, but perpetrated the attack on school property 
without entering the building. One of those attackers carried his weapon out in the open, while the other concealed 
the firearm in a guitar case as he rode his bike to the school grounds. 


For 6 of the 41 incidents included in this study, there was little information available on the background of the 
attackers in both primary source files and open sources. As a result, those six attackers were removed from 
the analysis of behavioral histories. All percentages provided in the remainder of the report are based on the 
35 attackers for whom substantive information was available . 


Law Enforcement Contact 

Half of the attackers (n = 17, 49%) had contact with law enforcement prior to carrying out their attacks, which included 
prior arrests and other encounters, like welfare checks at home. For some (n = 6,17%), these prior contacts or 
interactions were with an SRO. 

PAST CRIMINAL CHARGES: About one-third of attackers (n = 11, 31%) had previously been arrested or faced criminal 
charges, and the crimes for which they were charged included both non-violent (n = 7, 20%) and violent (n = 6,17%) 
offenses. In some of these cases, the charges against the attacker were ultimately dismissed. The non-violent 
charges included alcohol or drug related offenses, a curfew violation, criminal conspiracy, shoplifting or theft, 
trespassing, and reckless driving. The violent charges included affray, assault with a deadly weapon, and weapons 
possession at school with intent to cause harm. Physical fights, which occurred both at home and at school, 
resulted in charges of disorderly conduct and disrupting public school. In one case, the charge was related to a 
domestic violence incident when the attacker physically assaulted his mother, threatened to kill her, and ended up 
having to undergo a mental health evaluation. None of the charges were for sex offenses. 

An 18-year-old student shot and injured a classmate at his high school before surrendering to the SRO. According to 
investigative records, the attacker had been previously arrested for carrying a concealed gun , possession with the intent to 
distribute a controlled dangerous substance, trespassing, and resisting a public officer. 

OTHER CONTACT WITH LAW ENFORCEMENT: Some attackers (n = 10, 29%) had prior interactions with law enforcement 
that did not result in arrests or charges, or were related to issues with their families. These types of interactions 
included instances where the attacker had gotten into fights or displayed other inappropriate behavior at school and 
was spoken to by the SRO as a result. In one case, the prior contact was part of a threat assessment conducted by 
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school officials during which the SRO searched the attacker’s home for weapons. Prior contact with law enforcement 
also involved an attacker being detained by law enforcement after being reported as a runaway and police visits to 
attackers’ homes for issues regarding the attackers’ families. 

Psychological, Behavioral, & Developmental Health 

According to national prevalence rates, nearly 20% of children are diagnosed with at least one mental health and/or 
behavioral disorder. 15 In this study, a documented mental health diagnosis was received by fourteen (40%) of the 
attackers prior to their attack. 

This section will focus on the observable mental health symptoms displayed by attackers prior to their attack. Such 
mental health factors were divided into three main categories: psychological, behavioral, and neurological/ 
developmental. Most of the attackers (n = 32, 91%) in this study exhibited symptoms in at least one of these 
categories, and half of the attackers (n = 17, 49%) displayed symptoms of more than one type, with the most frequent 
combinations involving psychological and behavioral symptoms. When considering such signs and symptoms, it is 
possible that underlying situational factors may be the cause of the behavior (e.g., stressors the child is 
experiencing), as opposed to a diagnosable disorder. 


Symptom Categories 



Psychological 

24 

69% 

Behavioral 

20 

57% 

Neuro/Developmental 

7 

20% 


The vast majority of individuals in the United States displaying the symptoms or traits identified in this section 
do not commit acts of crime or violence. The symptoms described in this section constitute potential 
contributing factors, as part of a constellation of other factors, and should not be viewed as causal explanations 

for why the attacks occurred. 


Psychological 


This section describes attackers who exhibited several clusters of 
emotional and psychological symptoms. The most common of these 
types of symptoms was related to depression, with two-thirds of the 
attackers (n = 22, 63%) exhibiting some sign or symptom. A similar 
number of attackers (n = 21, 60%) also experienced suicidal thoughts 
and ideations. 16 Anxiety (n = 10, 29%), anger (n = 9, 26%), and 
symptoms of psychosis (n = 7, 20%) were also documented in the 
available sources of information. 


Common Psychological Symptoms 



Depressive Suicidal Anxiety Anger Psychotic 
ideation 
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A 16-year-old student shot his high school principal in the arm before his weapon malfunctioned. Prior to the incident , the 
attacker exhibited a wide range of symptoms typically associated with depression. For example , he began to isolate himself 
after his parents divorced and his siblings moved out of the home. While he had played multiple sports and enjoyed video 
games , the attacker withdrew from these activities as his depression worsened. He began going to school without shaving, 
showering , or washing his hair , and multiple people noted his body odor. The student reported feeling helpless , hopeless, and 
worthless , and he said he had low energy trouble sleeping, reduced appetite , decreased interest in activities , impaired 
concentration, and his grades began to decline. He often sat alone in his room in the dark. He began having suicidal thoughts 
and came close to killing himself prior to the incident. According to media reports > a state psychiatrist concluded that mental 
illness played a role in the attacker's actions in carrying out the incident. 

Behavioral 


Twenty attackers (57%) displayed behavioral symptoms, 
including defiance towards authority, poor impulse control, 
and other violations of social norms. Also included here 
are those attackers who exhibited symptoms of, or were 
diagnosed with, ADHD or ADD. Anger was included here if it 
occurred in the absence of any identifiable psychological or 
emotional issues that would account for it. 


Symptom/Behavior 



Defiance/misconduct 

14 

40% 

ADHD/ADD 

10 

29% 

Aggression 

8 

23% 

Anger 

5 

14% 

Animal cruelty 

3 

9% 


A 15-year-old student shot and injured two classmates at his high school. The attacker had a history of misconduct beginning 
at a young age. His academic record included dozens of discipline referrals at school for disobedience , disrespect to teachers , 
threats , harassment, and assault. He had numerous in-school and out-of-school suspensions. In 6th grade a/one, he had 24 
discipline referrals from 5 different staff members. The reasons for the referrals included refusing to cooperate with authority 
and altercations with peers. He was viewed as a bully and repeatedly tried to pick a fight with the boy he later targeted in 
the shooting. 

Neurological/Developmental 

Neurological conditions or developmental issues were found for seven attackers (20%), which included developmental 
delays, cognitive deficits (e.g., poor problem-solving or decision-making skills), and learning disabilities (e.g., dyslexia), 
and symptoms or diagnoses within the autism spectrum. 


Attackers in this category often experienced delays in language 
acquisition (e.g., lifelong speech challenges, not conversing 
until five years old), sensory sensitivity (e.g., covering ears when 
other kids were loud, disliking school assemblies, or attempting 
to avoid pep rallies due to noise), and poor communication skills 
(e.g., saying things that did not make sense). In addition, these 
students often misinterpreted social cues or isolated 
themselves. With an inability to integrate socially and 


Neurological/Developmental Symptoms 

Sensory Sensitivity Cognitive Deficits 
Poor Communication Learning Disabilities 
Developmental Delays Poor Social Skills 
Delayed Language Acquisition 
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communicate effectively, most of the attackers who experienced these conditions had difficulty regulating their 
emotions, while also experiencing other psychological and/or behavioral symptoms. 

A 12-year-old student fatally shot one teacher and wounded two classmates at his middle school , before killing himself. 
According to open source reporting , the attacker was late in his language development and required speech therapy. As he 
progressed through elementary school he continued to have problems with communication , cognitive deficits , and academics. 
In 6th grade , he was still performing 1st grade work in math and 2nd grade work in reading. The attacker exhibited poor social 
skills and did not make friends easily. His ability to pick up on social cues was limited , and he had difficulty with transitions 
from one activity to another. His emotions were unstable , with frequent episodes of anxiety anger ; and crying. He often 
seemed confused and was described as being in his own world. 

Personality Traits 

A fourth category, related to personality traits, was also considered, in order to highlight the personality dynamics that 
may have impacted the attackers’ behavior. A personality disorder is a manner of thinking, feeling, or behaving that 
falls outside of social norms and causes distress or problems functioning. It is possible that persistent patterns of 
defiance and misconduct at a young age may be indicative of a personality disorder as a student reaches adulthood. 
Research shows that as many as two-thirds of adolescents with a diagnosis of conduct disorder can go on to develop 
a personality disorder as an adult. 17 

One notable feature of attackers in this study with possible personality traits was narcissism, which manifested in 
multiple ways. These attackers generally had an inflated sense of self, believing that they were superior to others. 
Because they viewed themselves as superior, they had little concern for rules or laws, believing that they were above 
such conventions. Similarly, they did not respect people in positions of authority over them. Some of them sought 
fame through violence as a way to validate their inflated self-concepts. Furthermore, these attackers tended to lack 
empathy and derived sadistic pleasure from the thought of hurting or killing others. Further evidence of callousness 
was seen in their lack of remorse or emotional reaction to the enormity of what they had done. 

A student shot and injured a classmate and a teacher in his 
high school science classroom. The attacker had previously 
written stories and told friends about his desire to attack the 
school and his bullies. Prior to the incident, the attacker had 
expressed fantasies of killing and mutilating his brother , pushing 
a child out of a wheel chair , and punching a crying infant. 

Classmates also observed the attacker drawing portrayals of 
children being massacred on a playground. After the incident , 
investigators found journals with similar violent content. During trial , 
a psychologist retained by the prosecutor stated that attacker had 
antisocial, paranoid , and narcissistic features. 


Personality Traits 

Narcissistic Sadistic 

Deceitful Disregard for Rules 
Lacks Empathy Callous 

Manipulative 
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Mental Health Treatment 

Of the 35 attackers in this study, 19 (54%) had received some type of mental health treatment. Eleven (31%) had 
received services within their schools, and half (n = 17, 49%) had received services in the community. Nine of the 
attackers (26%) received services both at school and in the community. For some attackers, mental health treatment 
was in place at the time of the attack, while for others, the treatment had ended by the time the incident occurred. 

The fact that half of the attackers had received one or more mental health services prior to their attack 
indicates that mental health evaluations and treatments should be considered a component of a multidisciplinary 
threat assessment, but not a replacement. Keep in mind that standard mental health evaluations and treatments will 
not include things like a review of criminal records, corroborative interviews with people who know the student, an 
analysis of a student’s social media accounts, or a search of the student’s home or locker. Mental health 
professionals, both in and out of the school, should be included in a collaborative threat assessment process that 
also involves teachers, administrators, and law enforcement. 

Substance Use & Abuse 

Half of the attackers (n = 17, 49%) had a history of substance use and/or abuse. The most frequently used substances 
included marijuana (n = 14, 40%) and alcohol (n = 12, 34%). Some attackers used other controlled substances 
(n = 7, 20%), including opiates (e.g., Percocet, oxycodone), amphetamines (e.g., Adderall), Valium, Seroquel, K2, and 
anabolic steroids, none of which had been prescribed to them. A few attackers (n = 3, 9%) misused drugs that had been 
prescribed by a doctor, or over-the-counter (OTC) drugs, including Benadryl and cough syrup with codeine. 

For seven of the attackers (20%), their substance use reached the level of abuse, causing negative consequences or 
problems in their lives such as alcohol or drug related criminal charges, school suspensions, or being sent to drug 
treatment. 

A 16-year-old student stabbed and injured a classmate at his high school. Other classmates subdued the attacker until school 
officials arrived at the scene. According to court records, around the age of 13 or 14, the attacker began using marijuana and 
alcohol with his friends, as well as using non-prescribed oral steroids and abusing cough syrup containing codeine. The 
attacker reported that he consumed a four-ounce bottle of the cough syrup every two days for about a year. 

Weapons Use & Violence 

Weapons Use: Three-quarters of attackers (n = 27, 77%) had a history of using weapons prior to their attack. These 
histories included the attackers owning, using, training with, or practicing with weapons, including firearms, knives, or 
other types. For example, some attackers were experienced in hunting or target shooting, were members of the Junior 
Reserve Officer Training Corps (JROTC), had interests in airsoft guns, regularly carried a knife, or played with BB guns. 
While each of these activities, independently, do not indicate that a student poses a risk of violence, they do provide 
the student with familiarity, and in some cases explicit training, on how to handle and use weapons. 
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Twenty-five attackers (71%) had previous experience with firearms, 
including pistols, rifles, shotguns, and other weapons that closely 
mimicked firearms, such as BB guns, airsoft guns, and paintball 
guns. Thirteen attackers (37%) had previous experience with knives, 
outside of normal usage, and eleven (31%) had previous 
experience with both firearms and knives. Eight attackers (23%) had 
experience with other types of weapons, which included 
manufacturing explosives (e.g., pipe bombs) or incendiary devices 
(e.g., Molotov cocktails), or using a bow and arrow, nun chucks, 
throwing stars, or a machete. 

A 15-year-old student fatally shot one classmate and wounded one teacher, before killing himself. In his freshman year 
language arts notebook, the attacker had made several entries about weapons. He wrote, “Weapons-I know A LOT! About guns, 
knives, and body armor. I can tell the name of a gun... and tell you it’s [sic] caliber. I can also disassemble two guns.” The 
attacker’s brother had taken him shooting in the year prior to the attack, where they practiced shooting pellet guns, an AR-15 
style rifle, and a rifle the attacker had received as a gift from his brother for his birthday. During that same year, the attacker 
occasionally brought knives to school and showed them to at least one other student on the school bus. 

HISTORY OF VIOLENCE: Half of the attackers (n ■» 18, 51%) engaged in violent behaviors that did not result in an arrest 
or contact with law enforcement, including violence towards a family member (e.g., hitting a parent or stabbing a 
sibling), physical assaults (e.g., choking a friend or hitting another student), threatening or aggressive behavior (e.g., 
pointing a pair of scissors at and threatening to stab a classmate), or hurting animals. Additional cases of attackers 
with a history of violent arrests or criminal charges are described in the Law Enforcement Contact section of 
this report. 

A 14-year-old student killed his father at home, before opening fire on his former elementary school. One elementary student 
was fatally shot, and at least one other student and one teacher were injured. The attacker had a history of hurting small 
animals and watching videos of animals being hurt. 

INTEREST IN VIOLENCE AND WEAPONS: Half of the attackers (n = 17, 49%) had an unusual or concerning interest in 
violence or weapons. For example, some of the attackers researched past incidents of mass violence, drew figures of 
dead students, consumed violent or graphic media, completed writing assignments or kept journals referencing violent 
topics, hurt animals or watched videos of animals being abused, or described themselves as obsessed with weapons. 
For an interest in weapons to be concerning, it had to be viewed as a fixation or fascination that was beyond what 
would be considered a normal interest or knowledge of weapons. 

A 12-year-old student fatally shot a teacher and wounded two classmates at his middle school, before killing himself, in the 
months preceding his attack, the attacker conducted internet searches using the following terms: bullying, Top 10 evil children, 
Super Columbine Massacre Role Playing Game, shoot, guns, revenge, murder, school shooting, killer ; hate, and what if Nazi’s 
won WW2. The attacker also owned forty-seven first-person shooter video games and had saved photographs of the Columbine 
shooters on his phone. 


History of Weapons Use 



Firearm Knife Other 
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Two specific interests emerged as common and particularly concerning among the attackers. These were a fascination 
with the Columbine attack or an interest in Hitler and Nazism. 

• Columbine: About one-quarter (n = 8, 23%) of attackers displayed a concerning interest in the attack at Columbine 
High School. This was demonstrated by the attacker having saved photos of the Columbine attackers, watched 
documentaries or read about the attack, or paraphrased the diary of one of the Columbine attackers in their own 
diary. These attackers also consumed the movies or music that they knew the Columbine attackers had liked, spoke 
to friends about the attack, posted about it on social media, or wrote about Columbine in class assignments, 
journals, or manifestos. 

A 14-year-old student opened fire toward his SRO , burning the officer on the head with the discharging firearm. The attacker 
had previously written a report for class titled,"The Columbine High School Massacre.” Throughout his personal journal, he 
referenced the Columbine attackers , referring to them by nicknames , and also referenced a movie they liked. He wrote , 

“[The Columbine] story is SO fascinating to me!” and 7 “‘They're so... INSPIRATIONAL!” 

• Hitler/Nazism: Seven attackers (20%) displayed a concerning interest in Hitler or Nazism. This interest was revealed 
through a pattern of behavior, including attackers who turned in school assignments describing their admiration 

for Hitler, collected Nazi propaganda and Hitler speeches, used known Nazi references and symbols, viewed 
neo-Nazi websites, wrote about Hitler or Nazism in journals, or had conversations with classmates about 
these topics. 

A 14-year-old student fatally shot a classmate at his high school. The attacker was known to have shown an interest in Hitler , 
and he knew the names of all of Hitler’s deputies. After the attack , a copy of Hitler's Mein Kampf was discovered in the 
attacker’s backpack along with drawings of swastikas in his notebooks. A later search of the attacker’s residence identified 
Nazi paraphernalia , Nazi and white supremacist materials , anti-Semitic drawings , Nazi videos , Hitler speeches , and Nazi 
propaganda posters from Internet websites. 

Home Life Factors 

This section is intended to describe the family dynamics and home experiences for each of the 35 attackers, using 
several home life factors that emerged as common and impactful. While none of the factors included here should be 
viewed as predictors that a student will be violent, the field of study examining adverse childhood experiences (ACEs) 
finds that experiencing certain adverse events in childhood can result in a range of negative outcomes later in life, 
particularly when a child experiences multiple ACEs. 18 ACEs include things like parent separation and divorce, 
substance abuse in the home, family violence, abuse, family incarceration, and family mental illness. The first analysis 
of nationally-representative data on ACEs found that the percentage of youth displaying indicators of poor well-being is 
greater among those who have experienced three or more such factors. 19 In other words, the more ACEs a child 
experiences, the greater the risk for negative outcomes for the child. 
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All but two of the attackers (n = 33, 94%) experienced at least one of the home-life factors listed here. Those 
attackers experienced between one and six factors each, with an average of 3.4. 


Home Life Factors 

Parent(s) separated/divorced 

25 

71% 

Family financial difficulty 

24 

69% 

Parent(s) or sibling(s) arrested/incarcerated 

19 

54% 

Parent(s) or sibling(s) substance abuse 

16 

46% 

Family discord (including domestic violence/abuse) 

14 

40% 

Family mental health 

8 

23% 

Abuse/neglect suffered by the attacker 

8 

23% 

Non-parental custody/care 

4 

11% 


DIVORCE/SEPARATION: The most common home life factor experienced was parent divorce or separation, which was 
experienced by 25 of the attackers (71%). 

FINANCIAL DIFFICULTY: Twenty-four attackers (69%) experienced a home life with at 
least one indicator of financial difficulty. 

ARRESTS OR INCARCERATIONS: Nineteen attackers (54%) had a home life where a 
parent, guardian, or sibling was arrested or incarcerated at some point after the 
attacker’s birth. Research has found that the arrest or incarceration of a family 
member can have a number of negative consequences for childhood development. 

Children who witness a parent’s criminal activity, arrest, and incarceration have a 
greater likelihood of emotional maladjustment and a harder time regulating 
their emotions. 20 

A 15-year-old student fatally shot a classmate at her high school. She then fled the 
scene before turning herself in. At the time of the incident, the attacker’s father was 
serving a 25-year sentence for second-degree murder. He was arrested two years 
prior to the attack. While the attacker had not visited her father in prison , she was 
able to speak with him on the phone and had lived with him intermittently prior to 
his incarceration. 

SUBSTANCE ABUSE: Sixteen attackers (46%) had parents, guardians, or siblings using or abusing illicit drugs or 
alcohol. Research has found that children of parents with substance use disorders are more likely to experience 
abuse or neglect, develop behavioral problems, display violent behaviors, or engage in substance use themselves. 21 


Financial Difficulty 

Bankruptcy 

Eviction or Homelessness 
Failure to Pay 
Child Support 
Foreclosure 
Fraudulent Check(s) 
Lien 

Low Income 
Poverty 
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A 15-year-old student stabbed two classmates multiple times in the restroom. Both victims, selected at random , survived 
the attack. When she was a child , the attacker’s father was incarcerated multiple times for drug possession and other 
drug-related offenses. On at least one occasion prior to the attack , according to open source reporting, the attacker snuck out 
of her mother’s home in order to smoke marijuana with her father. 

FAMILY DISCORD: Fourteen attackers (40%) had evidence of exposure to family discord. The types of discord captured 
here varied, from repeated verbal arguments to domestic and other physical violence. These hostile events often 
occurred multiple times throughout the attackers’ lives, and most of these attackers experienced more than one 
type of family discord. 

A 17-year-old student entered his former high school and fatally shot three classmates and wounded three others. The 
attacker came from a troubled home with both of his parents involved in multiple unions and divorces. According to public 
records, both parents also had a history of criminal charges and substance abuse. Domestic violence was common in the 
home , and the parents’ criminal behavior resulted in the attacker ultimately being raised by his grandparents. 

FAMILY MENTAL HEALTH: Eight attackers (23%) had evidence of living with a family member in the home who 
experienced symptoms of a mental illness. The most prevalent conditions appeared to involve mood disorders 
(e.g., depression and bipolar disorder), with a few instances of possible psychosis. 

ABUSE/NEGLECT: Eight attackers (23%) suffered from neglect or were the victims of physical, verbal, or sexual abuse 
in the home. Physical abuse was the most common type of abuse, and five attackers experienced multiple types of 
abuse prior to their attacks. 

NON-PARENTAL CUSTODY/CARE: Four attackers (11%) were raised by someone other than a biological parent at some 
point in their lives. Three had lived with, or were raised by, their grandparents. One attacker had been placed in the 
foster care system and spent time in multiple foster homes before he was adopted. 

Stressors 

It is widely recognized that high stress levels are associated with emotional and behavioral problems for children. 22 All 
35 attackers (100%) experienced stressors, with nearly all (n = 33, 94%) experiencing at least one in the six months 
prior to their attack. Three-quarters of the attackers (n = 26, 74%) experienced a stressor within one month of the 
attack, and half of the attackers (n = 18, 51%) did so within two days. Research indicates that some types of stress, 
like the loss of a loved one, can be tolerated by children if they have emotional supports to help them process the 
experience. 23 Even with those supports, however, children will be challenged if the stressors they experience are 
intense or frequent enough. In such cases, children may exhibit a range of responses, from depression 
to hyperactivity. 24 
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Types of Stressors Experienced by Attackers 
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SOCIAL: All of the 35 attackers (100%) in this study experienced at least one social stressor. Social stressors 
identified in this analysis included stress related to the attackers’ relationships with peers (e.g., bullying or other peer 
conflicts) or romantic partners. These types of stressors in particular, including peer rejection during childhood and 
adolescence, have previously been linked to depression, anxiety, substance use, and behavior problems. 25 For half of 
the attackers (n = 19, 54%), a social event, such as a breakup or an incident of bullying, was the most recent stressor 
experienced before carrying out their attack. Those stressors often occurred within a week prior (n = 11, 31%). 

A 16-year-old student stabbed and injured his classmate in the high school cafeteria with a knife. The attacker later described 
himself as having experienced chronic verbal and physical bullying throughout his childhood and adolescence. In the weeks 
leading up to the attack, the victim of the stabbing began to date the attacker’s ex-girlfriend , which angered the attacker. 

FAMILY: Stressors related to the attackers’ families included conflicts in the home, abuse or neglect by a parent, and 
family financial difficulties. Nearly all attackers experienced family-related stressors (n = 32, 91%). At least three 
attackers had a stressful interaction with a parent within one day of the attack. 

A 14-year-old student fatally shot one elementary school student and injured at least one other student and one teacher 
outside of his former elementary school. According to the attacker ; his father had been angry and aggressive over the previous 
24 hours, complaining about his finances and engaging in a confrontation with the attacker over homework. The attacker 
fatally shot his father before the attack at the school. 

ACADEMIC/DISCIPLINARY: Most attackers (n = 31, 89%) had experienced school stressors related to academic or 
disciplinary actions, including failing grades or school suspensions. More than half of the attackers (n = 21, 60%) had 
both academic and disciplinary issues. For seven of the attackers (20%), a disciplinary issue at school was the most 
recent stressor experienced prior to the attack. 

GENERAL PERSONAL: Two-thirds of the attackers (n = 22, 63%) experienced stressors that were unique or personal in 
nature, and therefore not as easily categorized. These stressors included a failed drug test, homelessness, or 
feeling unhappy with one’s physical appearance. At least three attackers (9%) had witnessed violence against a friend 
or loved one, including a death by stabbing. 
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CHANGING SCHOOLS: Over half of the attackers (n = 19, 54%) had changed schools at least once, not including the 
normal transition from primary to secondary schools. Those 19 attackers changed schools more than two times on 
average. Seven attackers (20%) had switched schools during the six months leading up to the attack. The reasons 
for the school changes included expulsions, placements in an alternative school setting, moving to a new residence, 
enrolling in school after homeschooling, and transferring for personal reasons (e.g., to avoid bullies). 

Some attackers experienced additional types of stressors that were less common, including stressors related to 

criminal or judicial activity (n = 10, 29%), physical health problems (n = 9, 26%), or problems at work (n = 6,17%). 
Only eight attackers were known to have been employed, and most of them were employed in the food service industry. 

The number of contexts in which the attackers in this study experienced stressors ranged from two to eight, with an 
average of five. Two of the attackers experienced stressors in all eight contexts. 

A 17-year-old former student fatally shot three classmates and wounded three others at his old high school. The attacker 
had reportedly been bullied by the targets of the attack, and he was angered that one of the victims was dating his 
ex-girlfriend. Years prior, the attacker’s parents had lost custody of him due to their drug and alcohol abuse. More recently the 
attacker struggled academically and was eventually transferred to an alternative school, but according to investigative files, his 
attendance at the alternative school suffered due to frequent migraine headaches. The attacker had a part-time job in the food 
service industry but he was not a good employee, and newer coworkers were promoted above him. Law enforcement were 
often called to the attacker’s home due to family issues. A few months before the attack, the attacker was cited by police after 
crashing his mother’s vehicle into a ditch. 

Bullying 

Bullying is a problem faced by students and continues to be identified as a factor in NTAC's research on targeted 
violence in schools. Most of the attackers in this study (n = 28, 80%) were bullied by their classmates. For more 
than half of the attackers (n = 20, 57%), the bullying appeared to be of a persistent pattern which lasted for weeks, 
months, or years. 

Bullying includes unwanted, aggressive behavior among school-aged children with an intent to do physical, social, or 
emotional harm; which involves a real or perceived power imbalance; and is, or could be, repeated. 26 Between 
one-quarter and one-third of students in the United States report that they have been bullied, while almost 
three-quarters of students and school officials have reported witnessing bullying. 27 The U.S. Department of Health and 
Human Services warns that bullying has lasting negative effects for those who are bullied, those who bully others, and 
those who witness bullying. 

The evidence presented here supports past research findings that bullying causes significant stress and harmful 
outcomes for students. Schools should adopt and enforce a zero tolerance policy towards bullying and should 
encourage students to report bullying when they witness it or are victims of it. School officials and other authorities 
must act to intervene and stop bullying when it is reported to them, and bullying does not have to meet a legal 
threshold before schools can intervene. 
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TYPES OF BULLYING: The Centers for Disease Control and Prevention (CDC) identifies four types of bullying: verbal, 
physical, social, and property. 28 This study additionally incorporated cyber bullying. 

• Verbal: For nearly three-quarters of the attackers (n = 26, 74%), there was evidence that they experienced some 
form of verbal bullying. This included spoken or written forms of aggression. Examples of verbal bullying experienced 
by attackers prior to their attacks included threats, crude 
gestures, name calling, teasing, taunting, and suggestions 
that they kill themselves. 


• Physical: Many attackers (n = 14, 40%) experienced bullying that 
involved physical aggression. Examples included hitting, kicking, 
tripping, pinching, pushing, threatening or menacing gestures, and 
nonconsensual sexual contact. 


• Social: Six of the attackers (17%) experienced some kind of 
social bullying, which involved words or actions designed to harm 
the victim’s reputation or social standing. Examples included having rumors spread about them, being ostracized by 
others (e.g., classmates got up and left when the attacker sat down at a table), and being maliciously ignored. 

• Property: Four of the attackers (11%) experienced bullying involving acts of theft or destruction of property. 

Examples included having money stolen and having toilet paper thrown at their house. 

• Cyber: A few attackers (n = 3, 9%) experienced cyber bullying, which involved the use of digital technologies, such 
as text messaging or social media platforms. Cyber bullying can be done in public or in private. Some cyber 
bullying occurs in a way that may only be known to the victim (e.g., direct text messages), while other cyber bullying 
may be broadcast for public view (e.g., publicly viewable social media posts). The attackers who were cyber bullied 
were harassed on social media and received threatening emails, social media messages, and text messages. 

Though verbal and physical bullying were the most common types of bullying experienced by the attackers, several of 

the attackers experienced three or four different types of bullying. 

VERBAL, PHYSICAL, AND PROPERTY BULLYING: A 12-year-old student fatally shot one teacher and wounded two classmates, 
before killing himself. The attacker had been teased and called names by his middle school classmates, including “gay’’ “lazy,” 
“stupid,” and an “idiot.” Classmates had poured water down his pants, and then said the attacker had wet himself. In other 
instances, the attacker had his pants pulled down by classmates, was tripped in the hall, and had money stolen from him. The 
attacker referenced some of these incidents in one of the suicide notes he left, which was addressed to classmates 
and teachers. 

VERBAL, PHYSICAL, SOCIAL, AND CYBER BULLYING: A 13-year-old student stabbed and injured a classmate multiple times 
in her head and arm at their middle school. The victim and her friends had called the attacker “ugly,” had pushed her in the 
hallway, had spread rumors about her, and had subjected her to threatening phone calls and internet messages. 
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WHO KNEW ABOUT THE BULLYING: From case-to-case, there were differences among who was aware of the bullying 
experienced by the attacker. In almost half of the cases (n = 16, 46%), at least one of the attacker’s parents was 
aware that their child experienced bullying. In 16 cases (46%) a classmate was aware, and in 12 cases (34%) a school 
official was aware. In five cases (14%), there was evidence that all three groups knew that bullying was taking place. 


A 13-year-old student attacked classmates with a knife , 
injuring four. Classmates knew that the attacker had 
experienced bullying for years and that he had 
threatened revenge. The attacker’s parents were aware of 
the bullying , and the attacker had sought help from the 
school nurse and school guidance counselor ; but the 
situation did not improve. 
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In three cases (9%), the attacker perceived himself as a victim of bullying, but no one else shared that perception. For 
example, one attacker noted in his journal that he had been bullied, yet no evidence could be identified to indicate the 
attacker’s parents, classmates, or school officials were aware of any bullying or the attacker’s perceived victimization. 

Of note, there were 10 instances (29%) where evidence indicates at least one classmate knew the attacker was being 
bullied, but no school officials were aware. This highlights the need for schools to establish climates that encourage 
both students and parents to share concerns with school staff. Providing students with a means to anonymously report 
bullying, while also ensuring that all students have at least one positive relationship with a school staff member, will 
help to encourage students to share actionable information when they observe incidents of bullying at school. 

WHERE BULLYING OCCURRED: The attackers experienced bullying most frequently at school, including on the bus. 
Bullying, however, was also experienced in private residences, in public spaces, online, and via phone calls and 
text messages. 
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BULLYING TOLERATED: In a few cases, there was evidence that school officials knew about the bullying an attacker was 
experiencing, but there was no indication that the school responded to address the bullying in any way. In other cases, 
when school officials did respond to address the bullying, the responses were minor and ineffective, or the responses 
made the bullying worse. 

A 16-year-old student shot and injured his classmate and a teacher. Prior to the attack , the attacker had sought help from 
a teacher after being bullied. In response , the teacher told the attacker to "man up.” The attacker’s mother later called the 
school about the bullying , but there is no evidence that school officials took any action to intervene. The only intervention 
occurred after the attacker got into a fist fight with his bullies , after which the attacker was suspended. At his trial after the 
shooting , several classmates testified that the attacker had been relentlessly bullied and teased. 

ATTACKERS AS BULLIES: Just over one-third of the attackers (n = 13, 37%) were bullies themselves. Prior to their 
attacks, these attackers bullied their classmates verbally, physically, and through cyber bullying. Nearly all of the 
attackers who had bullied others were also the victims of bullying 

A 14-year-old student shot and injured one classmate in his high school cafeteria. The attacker had been teased and called 
names. He had also been struck with binders , punched , and pushed around. The attacker also had a history of bullying others. 
He would insult other students or scream at them , and had pushed , kicked , and slapped his classmates. 
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School Interactions & Relationships 

STUDENT-TEACHER RELATIONSHIPS: Over one-third of the attackers (n = 13, 37%) had at least one positive 
relationship with a staff member at their current school. Positive relationships were perceived from the student’s 
and/or teacher’s perspective, and were evidenced by the attacker being well-liked by teachers; a teacher writing a job 
recommendation for the attacker; teachers complimenting the attacker’s academic work; and describing the attacker 
as a model student, a good kid, or a pleasure to have in class. In addition, there were a few cases where a school 
staff member attempted to make a positive impact on an attacker’s life prior to the attack, for example, by looking out 
for a student or checking in with them on a weekly basis to make sure they were okay. 

A similar number of attackers (n = 10, 29%) had a negative relationship with at least one staff member at their 
current school. Negative relationships were characterized by the attacker previously disliking or threatening a teacher, 
not feeling supported by staff, not receiving assistance from school staff when they needed help, thinking teachers 
were disrespectful, or the attacker being disrespectful toward teachers or refusing to follow directions. Only three 
attackers (9%) felt they had a neutral relationship with the staff at their current school, which was evidenced by the 
attacker describing their relationship with teachers as cordial. 

SOCIAL LIFE: The majority of attackers (n = 29, 83%) had at least one friend, and at least four of the attackers (11%) 
were in a romantic relationship at the time of their attack. Only a few attackers (n = 5,14%) appeared to have no 
friends or romantic relationships. 29 It is important to note that these relationships were seen on a continuum. For 
example, an attacker may have been described by others as having friends, but others also noted that the same 
attacker kept to himself. 

Academic Performance & Extracurricular Activities 

Recent Academic Performance: Attackers’ recent academic achievement was categorized as a positive, neutral, or 
negative performance for the school year in which they were enrolled at the time of the attack. For example, if the 
attack took place in February 2012, the academic performance was captured for the 2011-2012 school year. If the 
attack took place close to the start of the school year, the attacker’s academic performance was captured for the 
previous school year. The academic performance of seven attackers could not be identified. 

• Positive Performance: About one-third of the attackers (n = 12, 34%) demonstrated a positive academic 
performance through one or more achievements, to include making the Flonor Roll, earning grades of A’s and B’s, or 
being enrolled in an Advanced Placement (AP) class or a gifted/talented program. 

• Neutral Performance: Five attackers (14%) demonstrated a neutral academic performance. Those who were rated 
as neutral included those who received a broader range of grades (e.g., A’s, B’s, and C’s), or attackers who were 
able to raise their failing grades into more average levels. 
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Negative Performance: About one-third of the attackers (n = 11, 31%) demonstrated a negative academic 
performance, evidenced by failing classes, repeating a grade, not completing homework, or performing below 
grade-level. 


PROTECTING AMERICA’S SCHOOLS/ ANALYSIS OF TARGETED SCHOOL VIOLENCE/2019 


United States Secret Service 

NATIONAL THREAT ASSESSMENT CENTER 



ACADEMIC ASSISTANCE: Ten attackers (29%) received some form of academic assistance during their school career. 
This assistance took the form of special education services, tutoring received or recommended, working with an 
English as a Second Language (ESL) teacher, or a learning strategies teacher. Eight students had received an 
Individualized Education Program (IEP), or a 504 plan. 

CHANGES IN PERFORMANCE: Several attackers (n = 7, 20%) displayed a negative academic change in the year leading 
up to their attack, which was most often displayed through declining grades. Due to the change, they also experienced 
negative effects in other areas of their academics, for example, failing a class, being removed from an honors or gifted 
program, or being removed from a school sports team. For example, one attacker had ended his junior year with a 3.0 
GPA (B average). Within two months of the attack, the attacker’s GPA declined to a 1.7, as he was earning D’s and F’s 
in all of his classes during his senior year. 

EXTRACURRICULAR ACTIVITIES: Nearly three-quarters of the attackers (n = 25, 71%) had been involved in an 
extracurricular activity at school, in the community, or both. School extracurricular activities included sports, Junior 
Reserve Officer Training Corps (JROTC), band, theater, orchestra, choir, debate team, art club, and Spanish club. 
Extracurricular activities in the community included sports, Boy Scouts, lifeguarding, volunteering, chess club, and 
religious activities. 

NOTEWORTHY ACHIEVEMENTS: Just under half of the attackers (n = 16, 46%) accomplished at least one noteworthy 
achievement in their school career or in the community. These accomplishments were often related to: 

• Academics: Attackers received honors or awards for academic achievement, were enrolled in Advanced Placement 
(AP) courses or an honors/gifted/talented program, were selected to skip a class or grade level due to high 
proficiency, were on the honor roll, and graduated early. 

• Extracurricular Activities: Attackers won first place on a school sports team, received a scholarship for music camp, 
won an essay contest, and won a school talent show. 

• Social Achievements: An attacker was elected by classmates as Flomecoming Prince. 

• Other Personal Achievements: Attackers achieved a weight loss goal, became a deacon, earned a black belt in 
karate, appeared on television, gained a large number of subscribers to a YouTube channel, and successfully 
completed a marksmanship qualification program. 

Disciplinary History 

Almost three-quarters of the attackers (n = 25, 71%) received some form of school disciplinary action in the five 
years prior to the attack. The behaviors that elicited disciplinary actions occurred along a continuum in terms of 
severity, ranging from cheating or using profanity to threatening or engaging in physical assaults. As with many of the 
topics addressed in this report, the presence of these behaviors alone does not necessarily indicate that a student 
will carry out a targeted school attack. Flowever, gathering information about a student’s disciplinary history, along with 
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other behaviors and circumstances, will assist school officials in identifying appropriate interventions to support the 

student and decrease the risk of harmful outcomes. 

BEHAVIORS RECEIVING DISCIPLINE: Disciplinary actions resulted from a wide range of behaviors in the school setting. 

Attackers were disciplined for the following types of behavior: 

• Fighting: Fourteen attackers (40%) were disciplined for fighting at school. These incidents included fights on the 
school bus and hitting other students. 

• Classroom Conduct: Twelve attackers (34%) were disciplined for behavior that affected the classroom environment, 
including interrupting the teacher, causing a disturbance, using a cell phone, demonstrating a bad attitude, and not 
following directions. 

• Threatening/Violent Behavior: Eleven attackers (31%) were disciplined for displaying threatening or violent behaviors 
at school. This included having weapons on campus; angry outbursts; using violent language; threatening a teacher, 
the school, or classmates; drawing pictures that depicted killings; and sharing a note with classmates that implied 
the attacker was going to do something bad. 

• Academic Integrity: Seven attackers (20%) were disciplined for behaviors related to their academics, including 
cheating on a test, failing to complete homework, and stealing another student’s paper and claiming it as their own. 

• Inappropriate Language: Six attackers (17%) were disciplined for using inappropriate language in school. This was 
not limited to profanity, but also included the use of vulgar or abusive language, inappropriate comments, and 
name-calling towards teachers or classmates. 

• Tardiness/Truancy: Five attackers (14%) were disciplined for being tardy to school or to class. Eight attackers (23%) 
were disciplined for truancy, which included skipping class, leaving class and not returning, leaving school without 
permission, and refusing to attend school. 

• Banned Substances: Four attackers (11%) were disciplined for behaviors involving banned substances at school, 
including selling and distributing marijuana, possessing cigarettes or a cigarette lighter, possessing drug 
paraphernalia, and being under the influence of alcohol or drugs. 

• Harassment/Bullying: Four attackers (11%) were disciplined for bullying and harassing behaviors, which included 
groping a female classmate and pulling down a classmate’s pants. 

• Other Discipline: Beyond the categories described in this section, attackers were also disciplined for gambling, 
vandalism, riding a scooter on school property, violating the school dress code, riding a different school bus without 
permission, and miscellaneous misconduct incidents. 
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CONSEQUENCES RECEIVED: The types of school discipline received as a result of these behaviors varied, and some of 
the attackers received multiple actions for the same repeated behaviors. Twenty-five attackers (71%) received 
disciplinary action in the five years prior to their attack. The level or severity of the discipline ranged from classroom 
consequences (e.g., having the student’s seat moved) to being expelled or arrested, and there were a few cases in 
which an attacker was disciplined, but the type of discipline received was not specified in the attacker’s school 
records. Attackers received the following forms of discipline: 

• Suspension: Eighteen attackers (51%) had received at least one suspension from school. Suspensions included 
formal in-school suspensions (ISS) and out-of-school suspensions (OSS), as well as instances where a student was 
sent home from school, even if the school did not classify the discipline as a suspension. Attackers were issued 
suspensions for a broad range of behaviors, from disruptive behavior to death threats. The length of suspensions 
also varied, from a half-day to multiple days. 

A 16-year-old student shot and injured a classmate and a teacher in his high school science classroom. The attacker had been 
previously suspended for five days after making threats about killing other students on the school bus. 

• Parental Contact: Thirteen attackers (37%) received discipline in the form of parental notification. Parents were 
contacted through letters sent home, documents requiring a parent signature, phone calls home, and parent 
meetings with school staff. Some, but not all, of the meetings with parents involved the attacker as well. 

• Conversations with Staff: Eleven attackers (31%) received discipline in the form of conversations with teachers, 
administrators, or SROs. These meetings were either one-on-one or occurred in a group setting. In one case, an 
attacker had a reentry meeting with school staff to discuss his behavior and plan for his return to school following 
a suspension. 
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• Criminal Charges or Arrests: Eight attackers (23%) were arrested or criminally charged at school for various 
infractions, including possession of marijuana, simple assault, disrupting public school, affray, trespassing, and 
disturbing the peace. 

• Referrals for an Evaluation/Assessment/Support Services: Eight attackers (23%) were referred to a team or mental 
health professional for an evaluation, assessment, or support services. These included referrals for a threat 
assessment, risk assessment, and mental health evaluation. Referrals were also made to school counselors and 
school psychologists, and some students were placed on behavioral contracts or behavioral intervention plans. 

• Formal Documentation: Eight attackers (23%) received discipline in the form of formal documentation in their 
school record. Schools used formal documentation to create a record of behavior in the form of behavioral referrals, 
discipline referrals, school hearings, and progress reports. 

• Detention: Eight attackers (23%) received school detention or lunch detention, or were required to attend Saturday 
school for their behavior. 

• Classroom Consequences: Seven attackers (20%) received discipline in the form of classroom consequences. 

These consequences included placing the attacker in timeout, modifying assignment instructions, confiscating a cell 
phone, moving the attacker’s seat, removing the attacker from the class temporarily, or transferring the attacker to a 
different class permanently. 

• Expulsion: Six attackers (17%) had been expelled from school. An expulsion included being removed from the 
school system for a predetermined number of days or permanently removed from the school district. Expulsions 
resulted from an accumulation of multiple suspensions, fighting, threatening harm to other students or self, and 
bringing a weapon to school. 

• Other Consequences: Seven attackers (20%) received other school disciplinary actions, including removal from the 
football team, having to write a statement about their behavior, and having a scooter confiscated. 
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Threat Assessment 

A multidisciplinary school threat assessment team provides schools with a structured approach to identify students 
exhibiting threatening or concerning behavior, gather information to assess if the student poses a risk of harm to 
him/herself or the school community, and manage the risk through appropriate interventions, resources, and 
supports. 30 A threat assessment should focus on a range of behaviors, from lower-level concerns (e.g., self-harm, 
depressed mood, bullying) to imminent or direct threats of violence. It is critical that student threat assessments be 
multidisciplinary and focused on providing robust interventions to students assessed as posing any level of risk to 
themselves or others. 

Four attackers in this study (11%) were referred to their school’s threat assessment team prior to their attack. In each 
of these four cases, a student or teacher at the school reported to someone in a position of authority that the 
attacker had made a direct threat toward classmates or school staff. 



Who was the 

threat directed 

toward? 

Who reported 
the threat? 

Was a threat 

assessment 

completed? 

When was the 

assessment 

completed? 

What was the outcome? 

Case 1 

Staff Member 

Teacher 

Yes 

Within 1 year 
prior to attack 

Assessed as a low level of 
risk; parents monitored 
student; student saw 
psychiatrist once a week 

Case 2 

Specific Student 

The threatened 

student 

Yes 

Within 1 year 
prior to attack 

Out-of-school suspension; 
intervention plan 

Case 3 

Specific 

Student/School 

Teachers and 15 

students 

Yes 

Within 1 year 
prior to attack 

Assessed at risk level 4 
out of 5, where 1 is the 
highest risk; 
behavior/academic 
contract 

Case 4 

Threat 1 - 

Students 

The threatened 

student 

No 

Within 3 years 
prior to attack 

Staff determined the 

student did not meet 

criteria to be assessed 

Threat 2 - 
Students 

The threatened 
student 

Yes 

Within 2 years 
prior to attack 

Assessed as posing a 
threat; expelled for 21 
days; returned to school 
for the start of the new 
school year 
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Information was identified regarding some of the gaps and limitations in how the threat assessments in these four 
cases were conducted. For example, an independent review of one case (Case 1) was requested by the school 
superintendent and the local board of education following the attack. The resulting public report identified several 
limitations in how the attacker’s threat assessment had been conducted. 31 According to the report, these 
gaps included: 

• “...data sources used for the threat assessments were not specified on the form and many forms lacked 
specific behavioral information. Forms varied in completion and therefore it was also sometimes difficult to see 
the reasoning behind assigned risk levels." 

• “All steps of the [school district’s] process as outlined by [the school district] do not appear to have been 
followed by the [school] staff in the threat assessment of [the attacker]." 

• “There was only a two-person team in the threat assessment of [the attacker]. The SRO was not involved at 
the [threat assessment] meeting." 

• “No interviews were conducted with [the attacker] or his family outside the meeting process." 

Available court records related to Case 3 describe a threat assessment process that appeared comprehensive in 
regards to the volume of information gathered by the team about the concerning student. Of the 15 students who 
reported the attacker’s threatening behavior on the school bus, seven filed written incident reports to the school. 

As a result, the attacker was suspended for five days, and a threat assessment was initiated. The attacker met with 
the assistant principal and the school psychologist, and the threat assessment team conducted interviews with the 
attacker and his family, classmates, and teachers. The SRO checked the student’s residence for weapons, where 
the officer only located paintball guns. The assessment revealed that the attacker had spoken about his “dream of 
killing students," was a loner, and had concerned the assistant principal so much that “she made a point to check on 
him regularly and asked how he was doing almost daily." Despite this thorough and appropriate information-gathering 
process, the student was deemed to be low risk. The school rated him a “4" on a 5-point scale, where “1" would have 
indicated high risk. 

Concerning Behaviors 

Every attacker included in this analysis (n = 35,100%) exhibited concerning behaviors prior to their attack. In all 

but two of these cases (n = 33, 94%), concerning behaviors were displayed at school. About three-quarters of the 
attackers (n = 27, 77%) displayed concerning behaviors at home or in the community, and three-quarters displayed 
them online (n = 26, 74%). 

Concerning behaviors ranged from relatively minor activities, to actions that elicited fear in those who observed them. 
For example, some attackers made statements that were simply out of character for the attacker or displayed other 
minor changes in behavior, while in other cases, attackers made direct threats of violence or brought weapons to 

school. In most of the cases (n = 28, 80%), the attacker’s behavior elicited concern from bystanders regarding the 
safety of the attacker or those around them. 


43 


PROTECTING AMERICA’S SCHOOLS/ ANALYSIS OF TARGETED SCHOOL VIOLENCE/2019 


United States Secret Service 

NATIONAL THREAT ASSESSMENT CENTER 



These findings support previous Secret Service research projects examining targeted violence in other contexts (e.g., 
mass attacks in public spaces 32) , which routinely find that the vast majority of attackers displayed behaviors that 
elicit concern in others prior to their attack. These behaviors provide opportunities for school staff, law enforcement, 
families, and friends, to recognize students who are in crisis and intervene as appropriate. In this report, concerning 
behaviors refer to actions an attacker took, communications an attacker made, or other observable acts displayed by 
an attacker prior to their attack. 

Range in Severity 

In most cases, attackers displayed a behavior that was so concerning that it should have been met with an immediate 
response, including a threat assessment. These behaviors are seen as being objectively concerning or prohibited. 
Examples include threats to cause harm, violent acts, bringing weapons to school, and suicidal statements. Of note, 
references to suicide, though not necessarily an indication of potential violence, are concerning and require immediate 
intervention to protect the student involved. Thirty-one attackers (89%) had displayed objectively concerning or 
prohibited behaviors that were observed by others. These behaviors were reported to the attackers’ parents (n = 15, 
43%), school staff (n = 14, 40%), and other officials (n = 8, 23%), including law enforcement. In two-thirds of the 
cases (n = 23, 66%), at least one prohibited behavior was observed by classmates or adults that was not reported. 

Most attackers also displayed a range of lower-level concerning behaviors that observers may not have recognized as 
concerning without knowing the full context of the situation. These behaviors are seen as being part of a constellation 
of lower-level behaviors, and may not warrant an immediate safety response. Nonetheless, they should elicit some 
level of concern. Examples of these behaviors include a depressed or angry mood, conflicts between classmates, and 
an interest in violent topics. When these types of behaviors are assessed in context with other factors, the level of 
concern could increase. Thirty attackers (86%) exhibited a constellation of such lower-level behaviors. 
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Common Themes 

The analysis revealed 10 common themes among the concerning behaviors that were displayed by the attackers, 
meaning those behaviors that were observable to others. For example, while 28 attackers had experienced bullying, 
only 12 openly spoke about it. Each of the attackers in this study exhibited between two and eight of the below listed 
themes, with an average number of five. 

• Threats to the Target, Others, and/or Intent to Attack: Most of the attackers (n = 29, 83%) shared verbal, written, 
visual, or video communications that referenced their intent to carry out an attack, threatened the target, and/or 
threatened others. 

• Intense or Escalating Anger: Three-quarters of the attackers (n = 26, 74%) displayed behaviors or shared 
communications indicating significant or increasing anger. These behaviors included having angry outbursts at 
school or engaging in aggressive acts at home. 

• Interest in Weapons: Nearly three-quarters of the attackers (n m 25, 71%) 
stockpiled weapons or communicated about weapons in a way that 
indicated an unusual or concerning level of interest. For some, their 
interest in weapons was expressed through drawings or artwork, while 
others had developed a reputation among classmates for having 
an intense interest in guns, knives, or explosives. A few attackers had 
built and detonated explosives. 

• Sadness, Depression, or Isolation: Nearly two-thirds of the attackers Interest in weapons 

(n = 22, 63%) either spoke about their sadness, depression, or loneliness, 

Sadness, depression, 

or appeared to be experiencing these feelings through their observable or isolation 

behaviors. Some attackers confided in others about their feelings, or 

wrote about them online or in school assignments. Bystanders also Changes in behavior 

or appearance 

observed the attackers isolating themselves, withdrawing from others, 

appearing sad, or crying. Suicide and/or self-harm 

• Changes in Behavior or Appearance: More than half of the attackers 
(n = 20, 57%) exhibited observable changes in demeanor, appearance, 
or routine prior to their attack. Examples included increased apathy about 
life, decreased effort on school work, withdrawing from activities, 
decreased personal hygiene, spending time in new places or with new 
people, changes in eating and sleeping patterns, and changes in online 
behaviors (e.g., changing profile picture to something unusual for 
the person). 


Interests in violence 

Talk of being bullied 

Concerns over 
grades/attendance 

Harassing others 


Common Themes of 
Concerning Behaviors 

Threats to the target, 
others, and/or intent to attack 

Intense or escalating anger 
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• Suicide and/or Self-harm: Half of the attackers (n = 19, 54%) had communicated about, or engaged in behaviors 
related to, suicide or self-harm. In some cases, multiple friends knew that the attacker was suicidal. In other 
cases, evidence of self-harm was noted by friends, parents, and/or school staff. 

• Interest in Violence: About one-third of attackers (n = 13, 37%) spoke or wrote about their violent interests, 
including topics related to previous school attacks, Hitler/Nazism, and other violent themes. Sometimes these 
interests were shared openly, while in other instances the attacker was more subtle (e.g., viewing photos of 
previous school attacks while in the cafeteria). 

• Other common themes among the concerning behaviors included attackers talking about being bullied 

(n = 12, 34%), poor grades or attendance that elicited concerns from parents or school staff (n = 10, 29%), and the 
attackers harassing others (n = 5,14%). In three of the five cases involving harassment, the victim of the 
harassment was later targeted in the attack. 


Timing of Concerning Behaviors 

Three-quarters of the attackers (n = 26, 74%) displayed their most recent concerning behaviors within the two days 
prior to their attack. Nearly all of the attackers (n = 32, 91%) shared or exhibited such behaviors within one month of 
their attack. It should be noted, however, that these behaviors were not necessarily new, as nearly half of the 
attackers (n = 14, 40%) had been displaying concerning behaviors for more than a year prior to their attack. 


Communications 

Among the concerning behaviors displayed by an attacker, the 
communications they made to others provide particular insight 
into their thinking, motivations, and intention. The majority of 
attackers shared concerning communications verbally through 
in-person statements (n = 31, 89%). About half shared 
concerning electronic messages sent to a specific person or 
persons (n = 20, 57%) or posted online to groups or the general 
public (n = 17, 49%). One-third of the attackers (n = 12, 34%) 
conveyed concerning thoughts through school assignments (e.g., 
writing essays on violent topics). 

A 13-year-old student injured four classmates using a knife. Though disarmed by classmates, he was later found to have also 
brought a blowtorch, gasoline container, water bottle filled with a clear flammable liquid, firecrackers, a bottle of vodka, a 
mask used to prevent the inhalation of fumes, and several other knives. About one week prior, the attacker posted a video 
on YouTube titled,'Testing my Blowtorch,” in which he lit the flame on a gas blowtorch, presumably the same one he brought 
during the attack. 


Conveyance of 
Communication 


In-person 

31 

89% 

Electronic message 
to specific person(s) 

20 

57% 

Online posting 

17 

49% 

School assignments 

12 

34% 

Phone 

1 

3% 
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Most attackers (n = 27, 77%) threatened their targets or shared their intentions to carry out an attack. In two-thirds of 
the cases (n = 23, 66%), those communications gave some level of imminence to the attack. About 90% of attackers 
who selected specific targets had made a threat prior to the attack (see Appendix A: Statistical Analyses). 

A 15-year-old student fatally shot a classmate in her high school. The night before, the attacker texted a friend stating, “l can't 
take it anymore. I want to kill myself so bad, the pain she causes hurts too bad. I just want to blow my brains out." The next 
morning, she texted a friend at another high school saying that she was going to shoot someone and go to jail. Within an hour 
before the shooting, the attacker told a friend in class that she was going to make the victim feel ‘‘pain," showed the classmate 
her handgun, and began crying. 


Timing of Threats 

Two-thirds of the attackers (n = 23, 66%) communicated their intent to attack or threatened the target within two 
weeks of the attack, and half (n = 19, 54%) did so within two days. Over one-third of the attackers (n = 13, 37%) 
communicated their intent or threatened the target within an hour of the attack. 


Final Communications: Half of the attackers (n = 19, 54%) prepared or delivered final communications prior to their 
attack. While some attackers kept these communications to themselves (e.g., left a suicide note in their bedroom), 
over one-third of the attackers (n = 13, 37%) sent these communications to others. Final communications included 
manifestos, journal entries, goodbye messages to friends and family (sent by text message, email or internet posts), 
and wills or funeral requests. 

A 15-year-old student fatally shot four of his classmates and injured one other in his high school cafeteria, before killing 
himself All of the victims were his close friends or cousins. The day prior, he tweeted, “It won't last... It'll never last" and texted 
his ex-girlfriend asking her to meet after school so he could say goodbye. He also sent her a Facebook message that said, 
"read my messages tomorrow from 7:15 to 12:30." The attacker posted on Instagram, “Tell my mom I love her," and included 
an emoji image of a gun. On the day of the attack, the attacker drafted a message on his phone titled, "My funeral shit," which 
outlined how his funeral should be handled. Minutes before the shooting, he sent the prepared text message about his funeral 
to 14 of his family members. He also texted his father ; telling him, “Read the paper on my bed. Dad. I love you." 

Three of these attackers also took other actions that were akin to final acts, including one attacker who deleted his 
email account, one who hugged her father goodbye when being dropped off at school (which she had never done 
before), and another who said goodbye to his pets. 

Response to Concerning Student Behaviors 

The response elicited from those individuals who observed the attackers’ concerning behavior varied. The more 
cautious responses included actively avoiding the attacker (n = 7, 20%) or expressing concern to other peers 
(n = 8, 23%). In two-thirds of the attacks (n = 23, 66%), someone approached the attacker at least once to ask if the 
attacker was okay, offer help, or attempt to dissuade the attacker from engaging in any harmful acts towards 
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themselves or others. In fewer than half of the incidents (n = 14, 40%), adults received information about what a 
bystander had observed. These included classmates telling a parent or school staff member (n = 8, 23%), or adults 
talking to other adults to discuss their concerns about the attacker (n = 14, 40%). Ten cases (29%) involved other 
types of responses, including: 

• Parents: Attackers’ parents searched rooms for drugs, set a new curfew, confiscated an attacker’s pellet gun or 
knife, gave their son a punching bag to help him deal with anger, filed reports of their concern to the school district, 
or asked the school to develop an IEP for their child, 

• School Staff: School personnel removed the student from an activity, made the student throw away violent drawings, 
sent a school memo to other school staff informing them that the attacker and the victim were not to be left alone 
together, developed plans to escape the school if the student were to do something violent, or considered 
resignation from the school to protect himself and the community, 

• Students: Classmates warned peers of the attacker’s intentions if they were viewed as potential targets and filed 
reports of their concern to the school district. 

In just under half of these cases (n = 16, 46%), the observed behavior elicited a significant response, including school 
staff calling the police in response to a criminal act or concern for safety, school staff suspending or expelling the 
attacker, or family members getting the attacker a mental health evaluation or therapy. In one case, the attacker 
himself asked for mental health treatment after police responded to a physical altercation between him and his 
mother at home. 

In two-thirds of the attacks (i? = 23, 66%), there was at least one communication by the attacker about his or her 
intent to attack, or another observed threatening behavior, to which there was not a response. Some of the 
reasons provided by bystanders for not reporting their concerns, included: 

• Classmates believed that the attacker was joking, or they dismissed the threat, because the attacker had a 
history of making threatening statements and had never done anything before. 

• Classmates believed that they had helped calm the attacker down enough that they would not act on the 
suicidal or homicidal statements, or classmates had checked in on the attacker and decided he or she was fine. 

• Classmates feared what the attacker may do to them if they reported what they knew. 

• Classmates intended to try to help the attacker with his or her problems, but the attack occurred sooner than 
they expected. 

• Classmates believed the attacker would do something violent, but did not think it would happen at school. 

• A teacher assumed that an administrator would take action, because the administrator had observed the same 
concerning behavior that the teacher had witnessed. 
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PART III: IMPLICATIONS 


Like the February 14, 2018 shooting at Marjory Stoneman Douglas 
High School in Parkland, FL, this analysis suggests that many of 
the 41 attacks described in this report could have been prevented. 
Like the Parkland attacker, many of the attackers in this study had a 
history of violent, threatening, and other concerning behavior; prior 
contact with law enforcement; instability in the home; access to and 
inappropriate interest in weapons; or issues related to psychological, 
emotional, or behavioral factors. While every situation is unique and 
should be treated as such, one common factor across all of these 
tragedies is that there appears to have been an opportunity to iden¬ 
tify and intervene with the attacker before violence occurred. 


States Mandating Threat Assessment 

In 2013, Virginia became the first state to 
legislatively mandate the use of threat 
assessment teams in K-12 schools under 
state law. 

In more recent years, other states have 
passed similar laws that require threat 
assessment teams at the school or district 
level. Some additional states have proposed 
such legislation. 


Threat Assessment is the best practice for preventing targeted violence. The goal of a threat assessment is to 
identify students of concern, assess their risk for engaging in violence or other harmful activities, and deliver 
intervention strategies to manage that risk. Schools should implement a threat assessment process in conjunction 
with the most appropriate physical security measures as determined by the school and its community. 


Threat assessment procedures should recognize that concerning student behaviors occur along a continuum, from a 
constellation of lower-level concerning behaviors (e.g., depressed mood and behavior changes) to behaviors that are 
objectively concerning or prohibited (e.g., threats of harm and physical assaults). Many of these behaviors that elicit 
concern may not involve physical violence or criminal acts, but still require an assessment and appropriate 
intervention. The threshold for intervention should be low, so that schools can identify students in distress before 
their behavior escalates to the level of eliciting concerns about safety. 

The threat assessment process begins with establishing a comprehensive targeted violence prevention plan, as 
described in Enhancing School Safety Using a Threat Assessment Model: An Operational Guide for Preventing 
Targeted School Violence . The guide provides a framework for establishing an effective threat assessment process 
intended to proactively intervene with students who may pose a risk of violence or other unwanted behavior. The steps 
include establishing a multidisciplinary threat assessment team of highly trained school personnel; defining 
concerning and prohibited behaviors; establishing and providing training on a central reporting mechanism; 
determining the threshold for law enforcement intervention; establishing threat assessment procedures and 
investigation protocols; developing risk management options; creating and promoting a safe school climate; and 
providing training for school personnel, students, parents, and law enforcement. 

The findings in this report underscore the importance of establishing a targeted violence prevention plan. A 
multidisciplinary threat assessment team, in conjunction with the appropriate policies, tools, and training, is the best 
practice for identifying, assessing, and managing students who elicit concern. Major findings, and their implications on 
the threat assessment process, are highlighted here. 
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Key Findings and Implications 

There is no profile of a student attacker ; nor is there a profile for the type of school that has been targeted . 

Attackers varied in age, gender, race, grade level, academic performance, and social characteristics. The use of a 
student profile or checklist does not yield accurate or useful results when determining the risk a student poses for 
conducting a school attack. Similarly, there was no identified profile of the type of school impacted by targeted 
violence, as schools varied in size, location, and teacher to pupil ratio. Rather than focusing on a set of traits or 
characteristics, a threat assessment process should focus on gathering relevant information about a student’s 
behaviors, situational factors, and circumstances to assess the risk of violence or other harmful outcomes. 

Attackers usually had multiple motives, the most common involving a grievance with classmates . 

Discovering a student’s motive for engaging in concerning behavior is critical to assessing the student’s risk of 
violence, and it allows the threat assessment team to intervene and develop management strategies that can redirect 
the student away from violent choices. This finding also highlights the importance of providing training on conflict 
mediation and coping skills for students. When multiple motives are involved, the school may need to implement 
multiple strategies to reduce the risk of unwanted behavior. 

Most attackers used firearms , and firearms were most often acquired from the home . 

The findings of this report illustrate that students can be very resourceful in accessing firearms stored in the home. 
While many of the attackers used unsecured firearms, others were able to gain access to firearms that were secured 
in a safe. It should be further noted, however, that some students perpetrated attacks using knives instead of 
firearms. Therefore, a threat assessment should explore if a student has access to any weapons, with a particular 
focus on weapons access at home. Schools, parents, and law enforcement must work together rapidly to restrict a 
student’s access to weapons in those cases when a student poses a risk of harm to self or others. 

Most attackers had experienced psychological, behavioral, or developmental symptoms . 

A recently published study that surveyed a sample (n = 16,000) of 10th-12th grade students found that providing or 
increasing mental health services for students was the most common factor selected by students as something that 
would increase feelings of safety at school, selected by more than one-third (38%) of students surveyed. 33 The findings 
of this survey, and those highlighted in this report, illustrate the importance of ensuring that students and parents 
have access to, and are informed about, mental health resources, social services, and substance use treatment. It 
should also be noted that many of the attackers in this study had received prior mental health treatment, illustrating 
that mental health treatment should be viewed as a component of managing risk. 

Half of the attackers had interests in violent topics . 

Half of the attackers in this study had displayed an unusual or concerning interest in violence or weapons. These 
types of interests, without an appropriate explanation, should initiate further information gathering, assessment, and 
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management by school personnel. For example, a student who is preoccupied or fixated on topics like the Columbine 
shooting or Hitler, as was noted in several of these cases, may be the focus of a school threat assessment to 
determine how such an interest originated and if the interest is negatively impacting the student’s thinking 
and behavior. 

All attackers experienced social stressors involving their relationships with peers and/or romantic partners. 

Every attacker in this study experienced at least one social stressor, frequently related to bullying. Many attackers 
experienced stressors in other aspects of their lives, as well, including family, academics, or school discipline. In 
addition to adopting and enforcing zero-tolerance policies on school bullying, schools should also provide students 
with strategies related to stress management and the development of coping skills. All school personnel, including 
teachers, administrators, and other staff members, should be trained to recognize signs of a student in crisis. 
Additional training should focus on crisis intervention, de-escalation, and suicide prevention. 

Nearly every attacker experienced negative home iife factors. 

The negative home life factors experienced by many of the attackers included parental divorce or separation, drug use 
or criminal charges among family members, or domestic abuse. While none of the factors included here should be 
viewed as predictors that a student will be violent, past research has identified an association between many of these 
types of factors and a range of negative outcomes for children. In some cases, school staff may not be aware of such 
home life factors that may be impacting how a student behaves at the school. Information-sharing among agencies 
is crucial in helping to address the impact of negative home experiences. For example, some cities and states have 
enacted laws that require law enforcement or other emergency care providers to inform school officials if a student is 
involved in, or present at, the scene of a traumatic event. Information sharing among schools, law enforcement, social 
services, and courts can help to ensure that the students most in need of additional resources do not 
go unrecognized. 

Most attackers were victims of bullying, which was often observed by others. 

In many cases, the school was aware that the attacker had experienced bullying, but the responses to the bullying 
varied. In some cases, the school did little to intervene or intervened in a way that caused the bullying to worsen. 
Students should be encouraged to report bullying that they experience or observe, both in and out of school. Students 
should also be provided an avenue to anonymously report such concerns, so that they can do so without fear of 
reprisal from classmates. Further, it is critical that schools implement comprehensive programs designed to promote 
safe and positive school climates, where students feel empowered to support the social and emotional wellbeing 
of classmates. 

Most attackers had a history of school disciplinary actions, and many had prior contact with law enforcement 

Most attackers had a history of receiving school disciplinary actions resulting from a broad range of inappropriate 
behavior. The most serious of those actions included the attacker being suspended, expelled, or having law 
enforcement interactions as a result of their behavior at school. An important point for school staff to consider is that 
punitive measures are not preventative. For example, two of the attackers in this study were suspended from school 
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at the time of their attack. If a student elicits concern or poses a risk of harm to him/herself or others, removing the 
student from the school may not always be the safest option. In other instances, disciplinary actions will be deemed 
necessary. To help in making the determination regarding appropriate discipline, schools should employ disciplinary 
practices that ensure fairness, transparency with the student and family, and appropriate follow-up. For example, the school 
should make efforts to maintain a positive rapport with the student and family, even during those instances of suspension 
or expulsion. This might include checking in on the student during his or her time out of school and taking steps to ensure 
a positive transition for the student when they return. 

All attackers exhibited concerning behaviors. Most elicited concern from others, and most communicated their intent 
to attack. 

The initial indicators of a student who was in distress or exhibiting concerning behavior were often observed by peers, 
school staff, family members, or others in their immediate community systems. The behaviors that elicited concern ranged 
from a constellation of lower-level concerns to objectively concerning or prohibited behaviors. Most of the attackers 
communicated a prior threat to their target or communicated their intentions to carry out an attack. In many of these cases, 
someone observed a threatening communication or behavior but did not act, either out of fear, not believing the attacker, 
misjudging the immediacy or location, or believing they had dissuaded the attacker. These findings continue to highlight the 
importance of encouraging students, school personnel, and family members to report troubling or concerning behaviors, in 
order to ensure that those in positions of authority can intervene. These same community members need to be trained on 
identifying risk factors for student violence and students in crisis. 

Conclusion 

NTAC’s experience delivering training and consultations for public safety entities has provided a first-hand account of what 
works, and of the challenges facing schools, law enforcement, and others tasked with keeping communities safe. 

NTAC knows that many of the recommendations offered in this report, and in NTAC’s Enhancing School Safety Guide, can 
be implemented by schools and their local partners right away. However, some key strategies for keeping schools safe 
can best be implemented only with the appropriate resources, policies, and authorities to support the effort. For example, 
several states have recently passed laws requiring schools or school districts to implement multidisciplinary school threat 
assessment teams. Similarly, some states have passed laws to create statewide, anonymous reporting tools, following the 
model of Safe2Tell™ Colorado. 

In some cases, grant funding may be available to support these efforts. For example, the STOP School Violence Act of 
2018 provides the U.S. Department of Justice’s Community Oriented Policing Services (COPS) Office the authority to 
provide monetary awards directly to states, units of local government, or Indian tribes to improve security at schools 
through evidence-based school safety programs, specifically including school threat assessment programs and anonymous 
reporting systems. 34 Some individual states have provided similarly intended grants to their schools and school districts, 
as well. 

The safety of children in school is a topic that everyone agrees on. Ensuring their safety requires leadership and vision, as 
well as common sense. A thorough review of the findings contained in this report should make clear that tangible steps can 
be taken to reduce the likelihood that any student would cause harm, or be harmed, at school. 
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CREATING A TARGETED VIOLENCE PREVENTION PLAN 

In July 2018, the Secret Service National Threat Assessment Center (NTAC) released Enhancing School Safety 
Using a Threat Assessment Model: An Operational Guide for Preventing Targeted School Violence , which outlined 
eight actionable steps for implementing a comprehensive targeted violence prevention plan in schools. The 
guide, which is available on the Secret Service public website, provides a framework for schools to identify, 
assess, and manage students who pose a risk of violence or other harmful behavior. 

Step 1: Establish a multidisciplinary threat assessment team of school personnel including faculty, staff, 

administrators, coaches, and available school resource officers who will direct, manage, and document 
the threat assessment process. 

Step 2: Define concerning behaviors , including those that are objectively concerning or prohibited, which should 
trigger an immediate intervention (e.g., threats, violent acts, or weapons on campus), and other 
lower-level concerning behaviors (e.g., depressed mood, interest in violent topics, or conflicts 
between classmates). 

Step 3: Establish and provide training on a central reporting system, like a smartphone application, an online 
form, or a dedicated school email address or phone number. Ensure that it provides anonymity to 
those reporting concerns, and is monitored by personnel who will follow-up on all reports. 

Step 4: Determine the threshold for law enforcement intervention especially if there is a risk of harm to self 
or others. 

Step 5: Establish threat assessment procedures that include practices for maintaining documentation, 

identifying sources of information, reviewing records, and conducting interviews. The assessment 
should be guided by an understanding of the thinking and behavior observed in past school 
attackers, as described in Protecting America's Schools: A l/.S. Secret Service Analysis of Targeted 
School Violence. 

Step 6: Develop risk management options to enact, once an assessment is complete. Create individualized 
management plans to mitigate identified risks. Notify law enforcement immediately if the student is 
determined to pose an imminent risk of harm to self or others. Take steps to ensure the safety of 
potential targets, create a situation less prone to violence, redirect the student’s motive, and reduce 
the effect of stressors. 

Step 7: Create and promote a safe school climate built on a culture of safety, respect, trust, and emotional 
support for students. Encourage communication, intervene in conflicts and bullying, and empower 
students to share their concerns. 

Step 8: Provide training for all stakeholders, including school personnel, students, parents, and 
law enforcement. 
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FINDINGS TABLE 


General Information (n = 41) 

Gender 

83% Male, 17% Female 

Age: average/range 

15 / 12-18 

Disposition: charged 

20 as adults, 10 as juveniles, 2 as both 

deceased 

7 suicides, 2 by law enforcement 

Backgrounds (n = 35) 

Substance use/abuse 

49% 

Contact with law enforcement 

49% 

Arrests or criminal charge(s): 

31% 

Other context: 

29% 

Mental health symptoms 

91% 

Psychological: 

69% 

Behavioral: 

57% 

Neurological/developmental: 

20% 

Mental health treatment 

54% 

Bullied 

80% 

Bullied others: 

37% 

School disciplinary histories (top 3 of 12) 

71% 

Fighting: 

40% 

Class misconduct: 

34% 

Threatening/aggressive behaviors: 

31% 

Suspended, expelled, or law enforcement intervention 

60% 

Investigative Themes (n = 35) 

History of weapons use 

77% 

History of anger or aggression 

74 % 

History of violent behavior: 

51% 

Violent interests 

49% 

Home life factors (top 3 of 8) 

94% 

Divorce/separation of parent(s): 

71% 

Finance: 

69% 

Arrest/incarceration of family member(s): 

54% 

Stressors (top 3 of 8) 

100% 

Social: 

100% 

Family: 

91% 

Academic or school disciplinary issues: 

89% 

Concerning behaviors (top 5 of 10) 

100% 

Intent to attack/threats: 

83% 

Anger: 

74% 

Wea pons-related: 

71% 

Depression: 

63% 

Behavior changes: 

57% 

Final communications or gestures 

54% 

Elicited concern about safety 

80% 
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Statistical tests revealed some significant differences among the attackers on topics involving their amount of planning, 
communication of threats, bullying experienced, target selection, motive, weapon used, and harm caused. Fisher’s exact 
tests of independence and chi-square tests of independence evaluated whether there were relationships between two 
dichotomous variables, with the appropriate test selected based on the number of cases within the subcategories (i.e., 
cross-tabulations with fewer than five cases in a cell required Fisher’s exact test). Computation of t tests for independent 
samples compared averages of some continuous variables (i.e., number of planning behaviors and number of deaths) 
across subsamples. All significance tests were two-tailed. The cutoff for statistical significance was an alpha level of .05; 
however, Appendix A presents some statistically non-significant, but substantively meaningful, results. The results should 
be interpreted with the understanding that students are only coded “yes” when there is evidence of the presence of the 
variable, and that absence of evidence is not equivalent to evidence of absence of the variable. 

Note: Due to the limited behavioral information available for 6 of the attackers, only 35 cases were included in 

the statistical analysis for the following three tests. 

• Although not statistically significant, attackers who engaged in more planning behaviors caused harm to a greater 
number of victims: Mass attackers averaged more than twice as many planning behaviors as attackers with fewer victims 
[t (33) = 1.98, p = .06]. 


Table 1: Number of Victims and Average Number of 

Planning Behaviors 

Number of Victims 

Average 

SD 

One or two victims (n = 25) 

1.4 

2.1 

Three or more victims (n = 10) 

3.1 

2.8 


• Most attackers who targeted specific people had made a prior threat: About 90% of attackers who selected 
specific targets had made a threat prior to the attack (p = .01). Less than 60% of attackers who targeted random 
individuals had made a threat in advance (p = .04). 


Table 2: Threatening Communications and Target Selection 


Random Target Selection 
(P = -04) 

Specific Target Selection 
(P = -01) 


Yes 
n (col.%) 

No 

n (col.%) 

Yes 
n (col.%) 

No 

n (col.%) 

Threat (n = 27) 

8 (57%) 

19 (90%) 

24 (89%) 

3 (38%) 

No Threat (n = 8) 

6 (43%) 

2 (10%) 

3 (11%) 

5 (63%) 

Total 

14 (100%) 

21 (100%) 

27 (100%) 

8 (100%) 
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• Although not statistically significant, a larger share of attackers who experienced a persistent pattern of bullying 
had bullying as a motive for carrying out the attack: Of the 20 attackers who experienced a persistent pattern of 
bullying, 12 (60%) had bullying as a motive, compared with one third who were not persistently bullied 
(X 2 = 2.44, p = .12) 


Table 3: Persistent Bullying and Bullying as a Motive 


Persistently Bullied 

Not Persistently Bullied 

Bullying as a Motive 
(n = 17) 

12 (60%) 

5 (33%) 

Attack Not Motivated by 
Bullying (n = 18) 

8 (40%) 

10 (67%) 

Total 

20 (100%) 

15 (100%) 


Note: All 41 cases were included in the statistical analysis for the following test 

• Nearly all attackers primarily motivated by a desire to kill targeted random victims: Six of the seven attackers (86%) 
whose primary motive was a desire to kill targeted randomly (p < .01). Only two of the seven attackers (29%) primarily 
motivated by a desire to kill had specific targets, compared with most individuals with a different motive 
(n = 29, 85%; p < .01). Five of the ten attackers (50%) who only targeted random victims were primarily motivated by a 
desire to kill (p < .01). 


Table 4: Target Selection and Desire to Kill 


Desire to kill was 
Primary Motive 

Other Primary 

Motive 

Random Target Selection 
(P < -01) 



Yes (n = 16) 

6 (86%) 

10 (29%) 

No (n = 25) 

1 (14%) 

24 (71%) 

Total 

7 (100%) 

34 (100%) 

Specific Target Selection 
(P < -01) 



Yes (n = 31) 

2 (29%) 

29 (85%) 

No (n = 10) 

5 (71%) 

5 (15%) 

Total 

7 (100%) 

34 (100%) 


• Incidents in which attackers used firearms were significantly more fatal than those involving knives: While the 
majority of both types of attacks were nonfatal, nearly half of the firearm attacks (n = 12, 48%) resulted in one or 
more deaths, while only 2 of 16 knife attacks (13%) were fatal (p = .04). 


Table 5: Fatalities and Weapon Used 

Fatalities 

Firearm 

Blade 

Zero 

13 

14 

One 

10 

2 

Two 

0 

0 

Three 

1 

0 

Four 

1 

0 

Total 

25 

16 

Mean (SD) 

0.68 (0.99) 

0.13 (0.34) 
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APPENDIX B: COMPARISON TO THE SAFE SCHOOL INITIATIVE 


In 2002, the U.S. Secret Service’s National Threat Assessment Center (NTAC) released the Safe School Initiative (SSI), 
which examined 37 incidents of targeted violence in schools committed by 41 attackers between 1974 and June 2000. 
Released 17 years later, Protecting America's Schools, examines 41 incidents committed by 41 attackers between 2008 
and 2017. In examining the major findings from both studies, a number of similarities were identified. In both studies, 
there was no one profile of a school attacker and there were similar percentages of those with criminal histories, substance 
abuse, types of mental health symptoms, and histories of being bullied or bullying others. Additionally, the majority had 
experienced stressors, exhibited concerning behaviors, and made their intentions to attack known to others. In Protecting 
America's Schools, however, the analysis delved deeper and identified additional factors that were not considered as part of 
the original study, including, but not limited to, the types of stressors, ways in which the attackers were bullied, the breadth 
of issues related to home life, the behaviors that elicited disciplinary action and their consequences, and various aspects 
of school dynamics. 

The following table offers some of the statistics from the two studies, however, comparisons between the two should be 
made only with caution as there were variations in research design and methodology, including variations of definitions, 
availability of case information, and access to internet-powered research tools. For instance, 17 years ago, studying 
targeted violence in K-12 schools was new and the method of identifying incidents would have been somewhat more 
challenging as there were no databases of incidents or lists of attacks to consult. Further, in more recent years, more 
attention has been focused on incidents of targeted violence, especially those affecting schools. Therefore, it is no surprise 
that similar numbers of incidents were found even though the timespan covered in the present study (10 years) is less 
than half that of the SSI (26 years). These factors may have also impacted why the current study identified more attacks 
than the SSI that were perpetrated using bladed weapons. 

Given these caveats, the following table presents the statistics which are most comparable. 
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Safe School Initiative 
(2002) 

Protecting America's Schools 
(2019) 

THE INCIDENTS 

n = 37 

n- 41 

Years 

1974 - 2000 

2008 - 2017 

Multiple attackers 

8% 

0 % 

Weapons 

97% firearm; 3% bladed; 

61% firearms; 39% bladed; 


8% had additional weapons 

7% had additional weapons 

Handguns 

67% of 36 firearms attacks 

72%o of 25 firearms attacks 

Long Guns 

50% of 36 firearms attacks 

36% of 25 firearms attacks 

Firearm from a residence 

73% of 36 firearms attacks 

76%o of 25 firearms attacks 

Victims that were specifically targeted 

46% 

56% 

Committed Suicide 

13%* 

17% 

THE ATTACKERS 

n = 41 

n = 35 (of 41) 

Gender, age, status 

100% male; ages 11-21 

83% male; ages 12-18 


95% current students 

90% current students 

History of any arrest 

27% 

31% 

violent crime 

17% 

17% 

Subject was abused/neglected 

27% 

23% 

Mental health diagnosis before 

17%* 

40% 

Mental health symptoms 



Depression 

61% 

63% 

Suicidal thoughts or gestures 

78% 

63% 

Suicide attempts 

10% 

11% 

Substance use and/or abuse 

49% 

49% 

Perceived as loners 

34% 

26% 

History of violence 

31% * 

51% 

Stressors 

98% 

100% 

SCHOOL PERFORMANCE 



Academic performance 



Positive 

41% 

34% 

Neutral 

37% 

14% 

Negative 

5% 

31% 

Not found 

17% 

20% 

Suspended (at least once) 

27% 

51% 

Expelled (at least once) 

10% 

17% 

Bullied by other students 

71% 

80% 

Subject bullied other students 

34% 

37% 

BEHAVIORS 



At least one person knew 

83% 

77% 

a peer 

83% 

77% 

an adult 

7% 

14% 

Concerning behaviors 

93% 

100% 

*Reflects calculations as reported in the Final Report and Findings of the Safe School Initiative (2002). 
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